Submitted by TomFrenchBlockchain, also found by pauliax
Loss of ability of TwapOracle to update should too many pools be added.
TwapOracle allows an unlimited number of pairs to be added and has no way of removing pairs after the fact. At the same time TwapOracle.update iterates through all pairs in order to update value for each pair.
https://github.com/code-423n4/2021-11-vader/blob/3a43059e33d549f03b021d6b417b7eeba66cf62e/contracts/twap/TwapOracle.sol#L322-L369
TwapOracle.registerPair is a permissioned function so that only the owner can add new pairs however should the owner account be compromised or not mindful of the number of pairs being added it is possible to put the oracle into a state in which it is unable to update. The oracle cannot recover from this state.
Possible options:
SamSteinGG (Vader) disagreed with severity:
alcueca (judge) commented:
SamSteinGG (Vader) commented:
