A compromised or malicious owner of PairsContrat can manipulate chainlinkFeed price

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/PairsContract.sol#L33-L37

Vulnerability details

Impact

Detailed description of the impact of this finding.
A compromised or malicious owner of PairsContract can manipulate chainlinkFeed price

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
A compromised or malicious owner of PairsContract can manipulate chainlinkFeed price as follows:

1. call setAssetChainlinkFeed(uint256 _asset, address _MalicousFeed), now the _maliciousFeed becomes the fake chainlinkFeed
2. false price can be provided by the _maliciousFeed and used in the advantage of the attacker to gain profit in trading

Tools Used

Remix

Recommended Mitigation Steps

The owner should be not allowed to change the chainlinkFeed, all chainlinkFeeds should be defined as constants and explicit. Use proxy pattern to include new feeds when necessary.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #418

[c4-judge]

GalloDaSballo marked the issue as duplicate of #377

[c4-judge]

GalloDaSballo marked the issue as satisfactory