L-12·

Oracle: irreversible token configuration

Not reportedoptionsleverageblack-scholes

TL;DR

The configToken function allows admins to whitelist a token and set its price feed.

Severity

LOW

Method

MManual review

CAT.

The configToken function allows admins to whitelist a token and set its price feed.

solidity

    function configToken(address token, address priceFeed) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
        if (address(tokenOracle[token]) != address(0)) revert TokenAlreadyConfigured();
        else whitelistedTokens.push(token);

        tokenOracle[token] = AggregatorV3Interface(priceFeed);
        emit TokenAdded(token);
    }

However, once a token is configured, it cannot be updated or removed. This becomes problematic if the token or its associated price feed becomes faulty, deprecated, or incorrect.

There is no way to recover from misconfiguration or respond to issues with oracles, which introduces operational risk and limits the flexibility of the system.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.