base to quote swaps trust GMX-provided minPrice and maxPrice to be correct, which may be manipulated
exchangeFromExactBase() in GMXAdapter converts an amount of base to quote. It implements slippage protection by using the GMX vault's getMinPrice() and getMaxPrice() utilities. However, such protection is insufficient because GMX prices may be manipulated. Indeed, GMX supports “AMM pricing” mode where quotes are calculated from Uniswap reserves. A possible attack would be to drive up the base token (e.g. ETH) price, sell a large ETH amount to the GMXAdapter, and repay the flashloan used for manipulation. exchangeFromExactBase() is attacker-reachable from LiquidityPool's exchangeBase().\\n```\\n    uint tokenInPrice = _getMinPrice(address(baseAsset));\\n        uint tokenOutPrice = _getMaxPrice(address(quoteAsset));\\n    // rest of code\\n    uint minOut = tokenInPrice\\n      .multiplyDecimal(marketPricingParams[_optionMarket].minReturnPercent)\\n        .multiplyDecimal(_amountBase)\\n          .divideDecimal(tokenOutPrice);\\n```\\n
Verify `getMinPrice()`, `getMinPrice()` outputs are close to Chainlink-provided prices as done in `getSpotPriceForMarket()`.
```\\n    uint tokenInPrice = _getMinPrice(address(baseAsset));\\n        uint tokenOutPrice = _getMaxPrice(address(quoteAsset));\\n    // rest of code\\n    uint minOut = tokenInPrice\\n      .multiplyDecimal(marketPricingParams[_optionMarket].minReturnPercent)\\n        .multiplyDecimal(_amountBase)\\n          .divideDecimal(tokenOutPrice);\\n```\\n