However, on their GIthub:
Warning: this is old code and will be replaced! This code is only provided for review and auditing, not for development. We have some changes prepared that will improve the development use case (while breaking the API of this one)...The code here works and is deployed. The change we're preparing is not yet deployed, so it's not here to avoid confusion.
Also, as with all the various Bitcoin lenders out there, I don't understand the fuss -- If the protocol operator controls the oracle (or even gets to pick it), can't they rug you any time they like? In which case, why not just do a traditional, custodial loan (ie, give them your bitcoin and get back whatever fiat currency)? It seems like a lot of extra steps for more or less similar threat models.
If you want to learn more about Firefish, check out their docs here: https://docs.firefish.io/firefish-protocol