Minting and burning synths exposes users to unlimited slippage

[code423n4]

Handle

TomFrench

Vulnerability details

Impact

The amount of synths minted / assets received when minting or burning synths can be manipulated to an unlimited extent by manipulating the reserves of the pool

Proof of Concept

See VaderPool.mintSynth:
https://github.com/code-423n4/2021-11-vader/blob/607d2b9e253d59c782e921bfc2951184d3f65825/contracts/dex-v2/pool/VaderPoolV2.sol#L126-L167

Here a user sends nativeDeposit to the pool and the equivalent amount of foreignAsset is minted as a synth to be sent to the user. However the user can't specify the minimum amount of synth that they would accept. A frontrunner can then manipulate the reserves of the pool in order to make foreignAsset appear more valuable than it really is so the user receives synths which are worth much less than what nativeDeposit is worth. This is equivalent to a swap without a slippage limit.

Burning synths essentially runs the same process in behalf so manipulating the pool in the opposite direction will result in the user getting fewer of nativeAsset than they expect.

Recommended Mitigation Steps

Add a argument for the minimum amount of synths to mint or nativeAsset to receive.

[SamSteinGG]

We believe the severity should be set to medium as there are no loss of funds and its exploit requires special circumstances to be profitable.