liquidation is vulnerable to sandwich attacks

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/AMM.sol#L144

Vulnerability details

when an account is liquidated, there is no minimum amount of the swap, which makes it vulnerable for sandwich attacks.

Proof of Concept

Alice's long position can be liquidated, bob notices it and creates a short position,
then liquidates her position, thus swapping the base asset to the quote asset,
therefore reducing the base asset price,
then he redeems his short position and profits because the price went down.

Tools Used

manual review

Recommended Mitigation Steps

set quoteAssetLimit in _reducePosition to prevent the attack

[atvanguard]

This is a known issue and is already documented as a @todo in the code.

[moose-code]

After long discussion we are going to side with warden on this one. The todo is a bit sparse and the warden really digs on what precautions need to be put in place and the ramifications if they are not adhered. In general, think sprinkle of todos should not indemnify issues related around them as this might let things slip through cracks as wardens will ignore these critical pieces.

[moose-code]

With the caveat of putting this in the medium and not high risk cat