Relying solely on oracle base slippage parameters can cause significant loss due to sandwich attacks
AaveLeverageStrategyExtension relies solely on oracle price data when determining the slippage parameter during a rebalance. This is problematic as chainlink oracles, especially mainnet, have upwards of 2% threshold before triggering a price update. If swapping between volatile assets, the errors will compound causing even bigger variation. These variations can be exploited via sandwich attacks.\\nAaveLeverageStrategyExtension.sol#L1147-L1152\\n```\\nfunction _calculateMinRepayUnits(uint256 _collateralRebalanceUnits, uint256 _slippageTolerance, ActionInfo memory _actionInfo) internal pure returns (uint256) {\\n    return _collateralRebalanceUnits\\n        .preciseMul(_actionInfo.collateralPrice)\\n        .preciseDiv(_actionInfo.borrowPrice)\\n        .preciseMul(PreciseUnitMath.preciseUnit().sub(_slippageTolerance));\\n}\\n```\\n\\nWhen determining the minimum return from the swap, _calculateMinRepayUnits directly uses oracle data to determine the final output. The differences between the true value and the oracle value can be systematically exploited via sandwich attacks. Given the leverage nature of the module, these losses can cause significant loss to the pool.
The solution to this is straight forward. Allow keepers to specify their own slippage value. Instead of using an oracle slippage parameter, validate that the specified slippage value is within a margin of the oracle. This gives the best of both world. It allows for tighter and more reactive slippage controls while still preventing outright abuse in the event that the trusted keeper is compromised.
Purely oracle derived slippage parameters will lead to significant and unnecessary losses
```\\nfunction _calculateMinRepayUnits(uint256 _collateralRebalanceUnits, uint256 _slippageTolerance, ActionInfo memory _actionInfo) internal pure returns (uint256) {\\n    return _collateralRebalanceUnits\\n        .preciseMul(_actionInfo.collateralPrice)\\n        .preciseDiv(_actionInfo.borrowPrice)\\n        .preciseMul(PreciseUnitMath.preciseUnit().sub(_slippageTolerance));\\n}\\n```\\n