M-10. Missing minimum token amounts in the emergency contract functions allows MEV bots to take advantage of the protocols emergency situation

plain text
function emergencyPause(
GMXTypes.Store storage self
) external {
self.refundee = payable(msg.sender);

GMXTypes.RemoveLiquidityParams memory _rlp;

// Remove all of the vault's LP tokens
_rlp.lpAmt = self.lpToken.balanceOf(address(this));
_rlp.executionFee = msg.value;

GMXManager.removeLiquidity(
self,
_rlp
);

self.status = GMXTypes.Status.Paused;

emit EmergencyPause();
}

plain text
struct RemoveLiquidityParams {
// Amount of lpToken to remove liquidity
uint256 lpAmt;
// Array of market token in array to swap tokenA to other token in market
address[] tokenASwapPath;
// Array of market token in array to swap tokenB to other token in market
address[] tokenBSwapPath;
// Minimum amount of tokenA to receive in token decimals
uint256 minTokenAAmt;
// Minimum amount of tokenB to receive in token decimals
uint256 minTokenBAmt;
// Execution fee sent to GMX for removing liquidity
uint256 executionFee;
}

plain text
function emergencyResume(
GMXTypes.Store storage self
) external {
GMXChecks.beforeEmergencyResumeChecks(self);

self.status = GMXTypes.Status.Resume;

self.refundee = payable(msg.sender);

GMXTypes.AddLiquidityParams memory _alp;

_alp.tokenAAmt = self.tokenA.balanceOf(address(this));
_alp.tokenBAmt = self.tokenB.balanceOf(address(this));
_alp.executionFee = msg.value;

GMXManager.addLiquidity(
self,
_alp
);
}