min max price on getMarketTokenPrice is not utilized such that deposit and withdrawal can use the same price, leading to free tx for cost-free manipulation
min max price on getMarketTokenPrice is not utilized such that deposit and withdrawal can use the same price, leading to free tx for cost-free manipulation\\nGMX provides getMarketTokenPrice on its synethicReader which leverages MarketUtils. It allows passing in index/long/short token price with min/max. The isDeposit flag would then be used to determine whether the min or max price would be used for calculating marketTokenPrice, this is important to always favor the protocol and prevent MEV.\\nHowever on the getMarketTokenInfo implemented in GMXOracle, it passes in the same price from the oracle to the min/max price for all long&short/lpToken. This implies the same pricing is used for both deposit and withdrawal, enabling user to freely deposit/withdraw without cost or slippage. Malicious users can use this to trigger rebalance, and hence deposit or withdrawal directly on GMX that benefit the attacker with the use of bundled tx.\\n```\\n    function getMarketTokenPrice(\\n        DataStore dataStore,\\n        Market.Props memory market,\\n        Price.Props memory indexTokenPrice,\\n        Price.Props memory longTokenPrice,\\n        Price.Props memory shortTokenPrice,\\n        bytes32 pnlFactorType,\\n        bool maximize\\n    ) external view returns (int256, MarketPoolValueInfo.Props memory) {\\n        return\\n            MarketUtils.getMarketTokenPrice(\\n                dataStore,\\n                market,\\n                indexTokenPrice,\\n                longTokenPrice,\\n                shortTokenPrice,\\n                pnlFactorType,\\n                maximize\\n            );\\n    }\\n```\\n\\nhttps://github.com/gmx-io/gmx-synthetics/blob/613c72003eafe21f8f80ea951efd14e366fe3a31/contracts/reader/Reader.sol#L187-L206
consider adding a small fee(5bps) to buffer the price returned from `_getTokenPriceMinMaxFormatted` on both sides.
free deposit and withdrawal due to the same token price is used for min or max price, which leading to the same marketTokenPrice calculation for deposit and withdrawal.
```\\n    function getMarketTokenPrice(\\n        DataStore dataStore,\\n        Market.Props memory market,\\n        Price.Props memory indexTokenPrice,\\n        Price.Props memory longTokenPrice,\\n        Price.Props memory shortTokenPrice,\\n        bytes32 pnlFactorType,\\n        bool maximize\\n    ) external view returns (int256, MarketPoolValueInfo.Props memory) {\\n        return\\n            MarketUtils.getMarketTokenPrice(\\n                dataStore,\\n                market,\\n                indexTokenPrice,\\n                longTokenPrice,\\n                shortTokenPrice,\\n                pnlFactorType,\\n                maximize\\n            );\\n    }\\n```\\n