0xpinky - lack of slippage protection in `_liquidateFlexible`

[sherlock-admin]

0xpinky

medium

lack of slippage protection in _liquidateFlexible

Summary

_liquidateFlexible is not providing the slippage protection.

Vulnerability Detail

function _liquidateFlexible(address trader, uint maxRepay, uint idx) internal whenNotPaused returns(uint /* repayed */) {
    LiquidationBuffer memory buffer = _getLiquidationInfo(trader, idx);

    // Q. Can user's margin cover the entire debt?
    uint repay = _seizeToRepay(buffer, margin[idx][trader].toUint256());

    // A.1 Yes, it can cover the entire debt. Settle repayAble
    if (repay >= buffer.repayAble) {
        _liquidateExactRepay(
            buffer,
            trader,
            buffer.repayAble, // exact repay amount
            idx,
            0 // minSeizeAmount=0 implies accept whatever the oracle price is  -------->>> code sets the slippage value as zero
        );
        return buffer.repayAble; // repayed exactly repayAble and 0 is left to repay now
    }

Impact

lack of slippage would hurt the user during the market fluctuation

Code Snippet

https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/main/hubble-protocol/contracts/MarginAccount.sol#L424C14-L440

this will be called from the function liquidateFlexible. when the other liquidation based function has this slippage protection but this one does not.

Tool used

Manual Review

Recommendation

Add slippage protection.

Duplicate of #196