Submitted by jonah1005
MochiEngine allows the operator to change the NFT contract in MochiEngine.sol#L91-L93
All the vaults would point to a different NFT address. As a result, users would not be access their positions. The entire protocol would be broken.
IMHO, A function that would break the entire protocol shouldnt exist.
I consider this is a high-risk issue.
MochiEngine.sol#L91-L93
Remove the function.
ryuheimat (Mochi) confirmed
