# priceLiquidity() may not work if PriceFeed.aggregator() is updated

DepositReceipt cached Chainlink aggregator min/maxAnswer at construction; if the proxy's aggregator is swapped, priceLiquidity reverts on stale bounds.

- Payout: Contest reward
- Severity: medium
- Program: Isomorph
- Credited: cccz
- Disclosed: 2022-11-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/145
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Solidity DepositReceipt_ETH/USDC contracts and Chainlink price feed proxy
**Root cause:** tokenMinPrice/tokenMaxPrice are read once from priceFeed.aggregator() in the constructor and never refreshed, but the Chainlink proxy owner can call confirmAggregator to swap the underlying aggregator, changing minAnswer/maxAnswer.
**Steps:**
1. Read DepositReceipt_ETH.sol constructor: `aggregator = IAccessControlledOffchainAggregator(priceFeed.aggregator()); tokenMinPrice = aggregator.minAnswer(); tokenMaxPrice = aggregator.maxAnswer();`
2. Observe getOraclePrice requires `signedPrice < _maxPrice` and `signedPrice > _minPrice` using these cached values
3. Note Chainlink proxy exposes `confirmAggregator(address)` (onlyOwner) which calls setAggregator and changes `aggregator()`
4. After aggregator swap, new min/maxAnswer differ; priceLiquidity() reverts on bound checks
**How found:** Code review of the constructor's one-time read of aggregator limits versus Chainlink proxy's mutable aggregator, confirmed by reading the on-chain proxy source.
**Insight:** When integrating Chainlink, don't cache aggregator-specific values (minAnswer/maxAnswer/decimals) at construction; the proxy can swap the aggregator, so read them per-call or use the proxy interface.