Part 2

Summary

The whole protocol depends on the price feed(s) set inside the PriceAdapter contract. If the feed(s) are down or the returned price is consistently stale the whole system will halt.

Vulnerability Details

The whole protocol depends on the price feed(s) set inside the PriceAdapter contract. If the feed(s) are down or the returned price is consistently stale the whole system will halt. This is due to two reasons:

1. The feeds cannot be easily changed, an upgrade is needed to change them.

2. There is no backup feed to ensure more reliability.

Impact

DoS of almost the whole protocol until an upgrade to the PriceAdapter contract is made.

Tools Used

Manual Review

Recommendations

To address both reasons:

1. Add functions to easily change feeds when there is a problem with them.

2. Add a backup feed to ensure more reliability with fetching prices and not introduce a single point of failure for the whole protocol.