Submission Details
Severity:
No functionality to update/reset token price feed in `ChainlinkARBOracle`
Vulnerability Details
For the function:
function addTokenPriceFeed(address token, address feed) external onlyOwner {
if (token == address(0)) revert Errors.ZeroAddressNotAllowed();
if (feed == address(0)) revert Errors.ZeroAddressNotAllowed();
if (feeds[token] != address(0)) revert Errors.TokenPriceFeedAlreadySet();
feeds[token] = feed;
}
In case when incorrect price feed is set by the owner for a token (it can happen), then it is not possible to reset to correct one and the token will become permanently unusable for the protocol.
Impact
feeds[token] cannot be reset once it is set.
Tools Used
Manual
Recommendations
Add a function called updateTokenPriceFeed() so this never becomes an issue.
Updates
Lead Judging Commences
hans almost 2 years ago
Submission Judgement Published Assigned finding tags:
Chainlink price feed can not be updated
Impact: High Likelihood: Low
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.