Steadefi

Summary

The ChainlinkARBOracle contract provides a function to set Chainlink price feeds for tokens. However, once a feed is set, there's no mechanism to update or remove it. This design restricts flexibility and adaptability in changing circumstances.

Vulnerability Details

The addTokenPriceFeed function in the ChainlinkARBOracle contract allows the owner to set a Chainlink price feed for a specific token. The function checks if a feed for the given token is already set and reverts if it is. This means, post the initial setting, the feed cannot be modified or removed.

This limitation can be problematic if the set feed becomes unreliable, is deprecated, or if there's a need to switch to a different, more reliable source.

Impact

1. Inflexibility: The contract might become stuck with outdated or unreliable data sources.

2. Need for Contract Redeployment: If a feed needs an update, the entire contract might need redeployment, leading to potential migration challenges.

3. Redundant Data: Without the ability to remove, deprecated tokens' data remain in the contract, leading to inefficiencies.

Tools Used

Manual Review

Recommendations

To address the above concerns, it is recommended:

1. Implementing an Update Function: This function will allow the contract owner to update the feed for a given token. Here's a potential implementation:

2. Implementing a Removal Function: This function will allow the owner to remove a feed for a token, setting its address back to the zero address:

By introducing these functions, the contract will be more adaptive and future-proof, reducing the need for potentially disruptive contract redeployments.