Keeper can make deposits/orders/withdrawals fail and receive fee+rewards
Malicious keeper can make execution of deposits/orders/withdrawals fail by providing limited gas to the execution.\\nIf enough gas is sent for the cancellation to succeed but for the execution to fail the keeper is able to receive the execution fee + incentive rewards and cancel all deposits/orders/withdrawals.\\n```\\nfunction executeDeposit(\\n        bytes32 key,\\n        OracleUtils.SetPricesParams calldata oracleParams\\n    ) external\\n        globalNonReentrant\\n        onlyOrderKeeper\\n        withOraclePrices(oracle, dataStore, eventEmitter, oracleParams)\\n    {\\n        uint256 startingGas = gasleft();\\n\\n        try this._executeDeposit(\\n            key,\\n            oracleParams,\\n            msg.sender,\\n            startingGas\\n        ) {\\n        } catch (bytes memory reasonBytes) {\\n            _handleDepositError(\\n                key,\\n                startingGas,\\n                reasonBytes\\n            );\\n        }\\n    }\\n```\\n\\nFor the attack to succeed, the keeper needs to make `this._executeDeposit` revert. Due to the 64/63 rule the attack will succeed if both of the following conditions meet:\\n63/64 of the supplied gas will cause an out of gas in the `try` statement\\n1/64 of the supplied gas is enough to execute the `catch` statement.\\nConsidering `2000000` is the max callback limit and native token transfer gas limit is large enough to support contracts the above conditions can be met.
Add a buffer of gas that needs to be supplied to the execute function to make sure the `try` statement will not revert because of out of gas.
Keeper can remove all deposits/withdrawals/orders from the protocol.\\nEssentially stealing all execution fees paid\\nKeeper can create deposits and by leveraging the bug can cancel them when executing while receiving rewards.\\nVaults will be drained
```\\nfunction executeDeposit(\\n        bytes32 key,\\n        OracleUtils.SetPricesParams calldata oracleParams\\n    ) external\\n        globalNonReentrant\\n        onlyOrderKeeper\\n        withOraclePrices(oracle, dataStore, eventEmitter, oracleParams)\\n    {\\n        uint256 startingGas = gasleft();\\n\\n        try this._executeDeposit(\\n            key,\\n            oracleParams,\\n            msg.sender,\\n            startingGas\\n        ) {\\n        } catch (bytes memory reasonBytes) {\\n            _handleDepositError(\\n                key,\\n                startingGas,\\n                reasonBytes\\n            );\\n        }\\n    }\\n```\\n