---
# System prepended metadata

title: high 01

---

## high 01
stale price check not present when fetching price from chainlink 

https://github.com/BuidlGuidl/Cohort-as-a-Service/blob/main/packages/hardhat/contracts/Libraries/PriceConverter.sol#L19

there is no check that the `timestamp` returned  is not stale

## med 01
`setBuilderApprovalRequirement` can be called the approval for the builder can be set to `false` even if `requireApprovalForWithdrawals` is `true` which breaks the protocol invariant

## gas 01
`isAdmin` & `primaryAdmin` storage vars can be removed to save gas as the oz access control lib can be used with a additional `PRIMARY_ADMIN` role as it is used for the `DEFAULT_ADMIN_ROLE` too

## gas 02 
`block.timestamp` can be directly read to save gas

https://github.com/BuidlGuidl/Cohort-as-a-Service/blob/main/packages/hardhat/contracts/Cohort.sol#L502