maintenanceMargin and minAllowableMargin can set below 0

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/ed1d885d5dbc2eae24e43c3ecbf291a0f5a52765/contracts/ClearingHouse.sol#L344

Vulnerability details

Impact

It is possible to

1. set maintenanceMargin <=0 which will make liquidation impossible and the protocol might default.
2. set minAllowableMargin <= 0 which will allow trader create infinte leverage.

Proof of Concept

https://github.com/code-423n4/2022-02-hubble/blob/ed1d885d5dbc2eae24e43c3ecbf291a0f5a52765/contracts/ClearingHouse.sol#L344

    function setParams(
        int _maintenanceMargin,
        int _minAllowableMargin,
        uint _tradeFee,
        uint _liquidationPenality
    ) external onlyGovernance {
        tradeFee = _tradeFee;
        liquidationPenalty = _liquidationPenality;
        maintenanceMargin = _maintenanceMargin;
        minAllowableMargin = _minAllowableMargin;
    }

Recommended Mitigation Steps

require(maintenanceMargin > 0, "maintenanceMargin <= 0");
require(minAllowableMargin >= maintenanceMargin, "minAllowableMargin < maintenanceMargin");

[atvanguard]

Duplicate of #40

[moose-code]

Less likely but similar to #84

[moose-code]

Grouping this together with #84

[JeeberC4]

Grouping with warden's QA report #89