Relevant GitHub Links
Summary
Chainlink does not provide a price feed for SOL token on Avalanche.
Vulnerability Details
One of the in-scope tokens
SOL on the Avalanche blockchain (see README.md) does not have a corresponding Chainlink pricefeed which makes pricing impossible as currently designed.
See available Chainlink pricefeeds herePrice Feeds are not set in the constructor of
GMXVault.sol so it is possible that the Strategy Vault could be deployed before the missing price feed was noticed.Impact
This issue affects some core protocol functions, which would make the core operations of a Strategy Vault using SOL on Avalanche impossible:
GMXReader.sol::convertToUsdValue()
GMXReader.sol::delta()
GMXOracle.sol::_getTokenPriceMinMaxFormatted()Tools Used
Manual Review
Recommendations
Use another Oracle for pricing SOL or remove SOL from the scope of eligible tokens on the AValanche chain.