MEDIUM severity: The existing slippage control mechanism in the MetaStable2 and Boosted balancer leverage vaults can . The existing slippage control mechanism in the MetaStable2 and Boosted balancer leverage vaults can be bypassed during vault settlement, allowing trades to be executed without considering the designated slippage threshold. This vulnerability affects the Emergency vault settlement process, Normal vau...

Vulnerable code:
```\n"postMaturitySettlementSlippageLimitPercent": 0.1, \n"emergencySettlementSlippageLimitPercent": 0.1\n```\n```\nFile: MetaStable2TokenAuraHelper.sol\n\nfunction settleVaultEmergency(\n    MetaStable2TokenAuraStrategyContext calldata context,\n    uint256 maturity,\n    bytes calldata data\n) external {\n    RedeemParams memory params = SettlementUtils._decodeParamsAndValidate(\n        context.baseStrategy.vaultSettings.emergencySettlementSlippageLimitPercent,\n        data\n    );\n\n    uint256 bptToSettle = context.baseStrategy._getEmergencySettlementParams({\n        poolContext: context.poolContext.basePool,\n        maturity: maturity,\n        totalBPTSupply: IERC20(context.poolContext.basePool.pool).totalSupply()\n    });\n```\n```\nfunction _decodeParamsAndValidate(\n    uint32 slippageLimitPercent,\n    bytes memory data\n) internal view returns (RedeemParams memory params) {\n    params = abi.decode(data, (RedeemParams));\n    DynamicTradeParams memory callbackData = abi.decode(\n        params.secondaryTradeParams, (DynamicTradeParams)\n    );\n\n    if (callbackData.oracleSlippagePercent > slippageLimitPercent) {\n        revert Errors.SlippageTooHigh(callbackData.oracleSlippagePercent, slippageLimitPercent);\n    }\n}\n```\n```\nFile: TradingModule.sol\n\nfunction executeTradeWithDynamicSlippage(\n    uint16 dexId,\n    Trade memory trade,\n    uint32 dynamicSlippageLimit\n) external override returns (uint256 amountSold, uint256 amountBought) {\n    trade.limit = PROXY.getLimitAmount(\n        trade.tradeType,\n        trade.sellToken,\n        trade.buyToken,\n        trade.amount,\n        dynamicSlippageLimit\n    );\n```\n```\nFile: TradingUtils.sol\n\nfunction _getLimitAmount(\n    TradeType tradeType,\n    address sellToken,\n    address buyToken,\n    uint256 amount,\n    uint32 slippageLimit,\n    uint256 oraclePrice,\n    uint256 oracleDecimals\n) internal view returns (uint256 limitAmount) {\n    uint256 sellTokenDecimals = 10 ** (\n        sellToken == Deployments.ETH_ADDRESS\n           ? 18\n            : IERC20(sellToken).decimals()\n    );\n    uint256 buyTokenDecimals = 10 ** (\n        buyToken == Deployments.ETH_ADDRESS\n           ? 18\n            : IERC20(buyToken).decimals()\n    );\n\n    if (tradeType == TradeType.EXACT_OUT_SINGLE || tradeType == TradeType.EXACT_OUT_BATCH) {\n        if (slippageLimit == 0) {\n            return type(uint256).max;\n        }\n        oraclePrice = (oracleDecimals * oracleDecimals) / oraclePrice;\n        limitAmount = (\n            (oraclePrice +\n                ((oraclePrice * uint256(slippageLimit)) / Constants.SLIPPAGE_LIMIT_PRECISION)) * amount\n        ) / oracleDecimals;\n        limitAmount = (limitAmount * sellTokenDecimals) / buyTokenDecimals;\n    } else {\n        if (slippageLimit == 0) {\n            return 0;\n        }\n        limitAmount = (\n            (oraclePrice -\n                ((oraclePrice * uint256(slippageLimit)) / Constants.SLIPPAGE_LIMIT_PRECISION)) * amount\n        ) / oracleDecimals;\n        limitAmount = (limitAmount * buyTokenDecimals) / sellTokenDecimals;\n    }\n}\n```\n```\ndef test_emergency_single_maturity_success(StratBoostedPoolUSDCPrimary):\n    env, vault = StratBoostedPoolUSDCPrimary\n    primaryBorrowAmount = 5000e8\n    depositAmount = 10000e6\n    env.tokens["USDC"].approve(env.notional, 2 ** 256 - 1, {"from": env.whales["USDC"]})\n\n    maturity = enterMaturity(env, vault, 2, 0, depositAmount, primaryBorrowAmount, env.whales["USDC"])\n\n    strategyContext = vault.getStrategyContext()\n    settings = dict(strategyContext["baseStrategy"]["vaultSettings"].dict())\n    settings["maxBalancerPoolShare"] = 0\n\n    vault.setStrategyVaultSettings(list(settings.values()), {"from": env.notional.owner()})\n\n    redeemParams = get_redeem_params(0, 0, \n        get_dynamic_trade_params(\n            DEX_ID["UNISWAP_V3"], TRADE_TYPE["EXACT_IN_SINGLE"], 11e6, True, \n            get_univ3_single_data(3000)\n        )\n    )\n\n    vault.settleVaultEmergency(maturity, redeemParams, {"from": env.notional.owner()})\n\n    vaultState = env.notional.getVaultState(vault.address, maturity)\n    assert vaultState["totalStrategyTokens"] == 0\n```\n```\nbrownie test tests/balancer/settlement/test_settlement_boosted_usdc.py --network mainnet-fork\nBrownie v1.18.1 - Python development framework for Ethereum\n\n=============================================================================================== test session starts ===============================================================================================\n\nplatform linux -- Python 3.8.10, pytest-6.2.5, py-1.11.0, pluggy-1.0.0\nplugins: eth-brownie-1.18.1, hypothesis-6.27.3, forked-1.4.0, xdist-1.34.0, web3-5.27.0\ncollected 1 item\n\ntests/balancer/settlement/test_settlement_boosted_usdc.py\nAttached to local RPC client listening at '127.0.0.1:8545'\n\ntests/balancer/settlement/test_settlement_boosted_usdc.py FAILED [100%]\n\n==================================================================================================== FAILURES =====================================================================================================\n```\n```\ndef test_emergency_single_maturity_success(StratBoostedPoolUSDCPrimary):\n    env, vault = StratBoostedPoolUSDCPrimary\n    primaryBorrowAmount = 5000e8\n    depositAmount = 10000e6\n    env.tokens["USDC"].approve(env.notional, 2 ** 256 - 1, {"from": env.whales["USDC"]})\n\n    maturity = enterMaturity(env, vault, 2, 0, depositAmount, primaryBorrowAmount, env.whales["USDC"])\n\n    strategyContext = vault.getStrategyContext()\n    settings = dict(strategyContext["baseStrategy"]["vaultSettings"].dict())\n    settings["maxBalancerPoolShare"] = 0\n\n    vault.setStrategyVaultSettings(list(settings.values()), {"from": env.notional.owner()})\n\n    redeemParams = get_redeem_params(0, 0, \n        get_dynamic_trade_params(\n            DEX_ID["UNISWAP_V3"], TRADE_TYPE["EXACT_IN_SINGLE"], 0, True, get_univ3_single_data(3000)\n        )\n    )\n\n    vault.settleVaultEmergency(maturity, redeemParams, {"from": env.notional.owner()})\n\n    vaultState = env.notional.getVaultState(vault.address, maturity)\n    assert vaultState["totalStrategyTokens"] == 0\n```\n```\nbrownie test tests/balancer/settlement/test_settlement_boosted_usdc.py --network mainnet-fork\nBrownie v1.18.1 - Python development framework for Ethereum\n\n=============================================================================================== test session starts ===============================================================================================\n\nplatform linux -- Python 3.8.10, pytest-6.2.5, py-1.11.0, pluggy-1.0.0\nplugins: eth-brownie-1.18.1, hypothesis-6.27.3, forked-1.4.0, xdist-1.34.0, web3-5.27.0\n\ncollected 1 item\n\ntests/balancer/settlement/test_settlement_boosted_usdc.py.\n\n========================================================================================== 1 passed, 1 warning in 4.31s ===========================================================================================\n```