Submitted by 0xA5DF, also found by 0xSmartContract, francoHacker, rbserver, kwhuo68, yjrwkk, 0xNazgul, peanuts, wait, ladboy233, hansfriese, philogy, Mukund,  0xA5DF, __141345__, carlitox477, Madalad, jadezti,  cccz, SmartSek, chaduke, hihen, gz627, 0xbepresent, Ruhum, 8olidity, Faith, imare, HE1M, 0xdeadbeef0x, aviggiano, JohnnyTime, orion, Englave, and gzeon
https://github.com/code-423n4/2022-12-tigris/blob/496e1974ee3838be8759e7b4096dbee1b8795593/contracts/Trading.sol#L222-L230 
https://github.com/code-423n4/2022-12-tigris/blob/496e1974ee3838be8759e7b4096dbee1b8795593/contracts/StableVault.sol#L78-L83 
https://github.com/code-423n4/2022-12-tigris/blob/496e1974ee3838be8759e7b4096dbee1b8795593/contracts/StableToken.sol#L38-L46 
https://github.com/code-423n4/2022-12-tigris/blob/496e1974ee3838be8759e7b4096dbee1b8795593/contracts/PairsContract.sol#L48
The project heavily relies on nodes/oracles, which are EOAs that sign the current price.
Since all functions (including withdrawing) require a recently-signed price, the owner(s) of those EOA can freeze all activity by not providing signed prices.
I got from the sponsor that the owner of the contract is going to be a timelock contract.
However, once the owner holds the power to pause withdrawals - that nullifies the timelock. The whole point of the timelock is to allow users to withdraw their funds when they see a pending malicious tx before its executed. If the owner has the power to freeze users funds in the contract, they wouldnt be able to do anything while the owner executes his malicious activity.
Besides that, there are also LP funds, which are locked to a certain period, and also cant withdraw their funds when they see a pending malicious timelock tx.
The owner (or attacker who steals the owners wallet) can steal all users funds.
TriHaz (Tigris Trade) acknowledged, but disagreed with severity and commented:
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
