shaka
medium
Lack of Chainlink price feed data validation.
It is not checked that the price value returned by priceFeed.latestRoundData() is in a specific range. Chainlink aggregator could send a wrong value. Although this is unlikely, given the crucial impact that this would have in the protocol, a safety check should be added to the received price value.
In the case of a negative value received for price, casting the value to a uint256 would cause the value to overflow.
In the case of a wrong price being received by Chainlink's aggregator, the whole rebalancing and minting functionalities would be broken and USSD would lose its peg.
Manual Review
(, int256 price, , , ) = priceFeed.latestRoundData();
if (price < minPrice || price > maxPrice) {
// Call an alternative price source or pause the protocol
}