$1.2M Protocol Exploit

function getPrice() external view returns (uint256) {
    return _computePrice();
}

function _computePrice() private view returns (uint256) {
    uint256[] memory prices = _sort(getAllSourcesPrices());

    // Returns median price from 3 sources
    if (prices.length % 2 == 0) {
        uint256 leftPrice = prices[(prices.length / 2) - 1];
        uint256 rightPrice = prices[prices.length / 2];
        return (leftPrice + rightPrice) / 2;
    } else {
        return prices[prices.length / 2];
    }
}

function buyTokens(uint amount) external payable {
    // Get gold price from oracle - NO SANITY CHECK!
    uint goldPrice = oracle.getPrice();
    uint totalPrice = goldPrice * amount;
    require(msg.value >= totalPrice, "Amount paid is not enough");

    // Mint tokens to buyer
    token.mint(msg.sender, amount);
}

function sellTokens(uint amount) external {
    // Get gold price from oracle - TRUSTS BLINDLY!
    uint goldPrice = oracle.getPrice();
    uint totalPrice = goldPrice * amount;

    // Burn tokens and pay seller
    token.burn(msg.sender, amount);
    payable(msg.sender).call{value: totalPrice}("");
}