The ChainlinkOracle.setManualPrice function specifies that it can only be called if manualOverride == true.
This is not the case.
Assume an oracle failure happened, and the oracle needs to be manually set to prevent losses.
The setManualPrice function succeeds and the owner might think that the oracle price is overwritten as the function would fail when manualOverride is not true according to specification.
The protocol would still use the broken chainlink price feed and suffer losses.
Add the missing require(manualOverride == true, "manual override not set") check.
lucas-manuel (Maple) acknowledged:
Nick Johnson (Judge):
Nick Johnson (Judge):
