Part 2

Summary

The protocol will be deployed on Monad chain. But the Chainlink Oracle doesn't support this chain. The other chain that the protocol uses is Arbitrum. On this chain there are two token pairs that don't have Chainlink Oracle price feed address.

Vulnerability Details

According to the README the protocol will be deployed on two chains and will work with the following tokens:

The protocol uses Chainlink Oracle to retrieve the price of different price feeds. The problem is that the Chainlink doesn't support Monad chain. This means the protocol can not work correctly on Monad chain and functions that rely on Chainlink price will revert.

There is also one more problem with the Chainlink compatibility this time on Arbitrum chain. The Collateral::getPrice function gets the oracle usd price of the given asset:

Tokens that can be used as assets are mentioned above. The problem is that there are two pairs that don't have Chainlink price feed addresses. They are WEETH/USD and WSTETH/USD. These collateral types have only ETH price feed.

Impact

The protocol is unable to support important functions such as getPrice from Chainlink price feed for a given collateral asset on Monad chain and all functions that rely on this functionality will not work.
Also, on Arbitrum network some of the tokens that the protocol supports don't have USD price feed. This means that the same important functionality for the WEETH/USD and WSTETH/USD pairs is broken. And this will result in asset loss for the users.

Tools Used

Manual Review

Recommendations

Implement another method for retrieving the asset/usd price on Monad chain. And for the unsupported tokens pairs you can first estimate the converted value from the supported assets to their unwrapped forms and then fetch the USD price from the ChainLink oracle.