HighSlippage vulnerability in the `LeverageModule` contract

Low/Info issue submitted by BZ

Summary

The HighSlippage vulnerability arises when the entry price of an order is higher than the maximum fill price specified in the order. This situation causes the order to revert with a "HighSlippage" error, preventing the execution of the order.

Vulnerability Detail

An attacker could exploit this vulnerability by manipulating the oracle price, causing it to deviate significantly from the actual market price. By doing so, they can consistently cause transactions to revert due to high slippage, disrupting the operation of the platform and denying users the ability to open positions. In the executeOpen, executeAdjust, and executeClose functions, there is a check for high slippage using a condition:

if (entryPrice > announcedOpen.maxFillPrice)
    revert FlatcoinErrors.HighSlippage(entryPrice, announcedOpen.maxFillPrice);

Impact

The functions check for high slippage during the execution of orders and revert the transaction if the price is higher/lower than the provided limit.

Code Snippet

https://github.com/sherlock-audit/2024-03-flat-money-fix-review-contest/blob/main/flatcoin-v1/src/LeverageModule.sol#L99

Proof of Concept

This could be achieved if you can manipulate the price data source that the oracle uses or if you have some control over the data that the oracle reads from.
Ensure that you have an account with enough funds to open leverage positions.

Tool used

Manual Review

Recommendation

Ensure slippage limits are set correctly and thoroughly tested.

sherlock-audit / 2024-03-flat-money-fix-review-contest-judging