Vulnerability: Missing minimum token amounts in the emergency contract functions allows MEV bots to take advantage of the protocols emergency situation
Severity: medium

Description:
When an emergency situation arises and the protocol pauses or resumes the operation of the vault. All funds of the vault are removed from GMX or added back to GMX without any protection against slippage. This allows MEV bots to take advantage of the protocol's emergency situation and make huge profits with it.\\nWhen an emergency situation arises the protocol owners can call the emergencyPause function to remove all the liquidity from GMX:\\n```\\nfunction emergencyPause(\\n  GMXTypes.Store storage self\\n) external {\\n  self.refundee = payable(msg.sender);\\n\\n  GMXTypes.RemoveLiquidityParams memory _rlp;\\n\\n  // Remove all of the vault's LP tokens\\n  _rlp.lpAmt = self.lpToken.balanceOf(address(this));\\n  _rlp.executionFee = msg.value;\\n\\n  GMXManager.removeLiquidity(\\n    self,\\n    _rlp\\n  );\\n\\n  self.status = GMXTypes.Status.Paused;\\n\\n  emit EmergencyPause();\\n}\\n```\\n\\nBut the minimum tokens amount to get back when removing liquidity is not provided to the RemoveLiquidityParams:\\n```\\nstruct RemoveLiquidityParams {\\n  // Amount of lpToken to remove liquidity\\n  uint256 lpAmt;\\n  // Array of market token in array to swap tokenA to other token in market\\n  address[] tokenASwapPath;\\n  // Array of market token in array to swap tokenB to other token in market\\n  address[] tokenBSwapPath;\\n  // Minimum amount of tokenA to receive in token decimals\\n  uint256 minTokenAAmt;\\n  // Minimum amount of tokenB to receive in token decimals\\n  uint256 minTokenBAmt;\\n  // Execution fee sent to GMX for removing liquidity\\n  uint256 executionFee;\\n}\\n```\\n\\nAs it is not set, the default value 0 (uint256) is used. Therefore, up to 100% slippage is allowed.\\nThe same parameters are also missing when normal operation resumes:\\n```\\nfunction emergencyResume(\\n  GMXTypes.Store storage self\\n) external {\\n  GMXChecks.beforeEmergencyResumeChecks(self);\\n\\n  self.status = GMXTypes.Status.Resume;\\n\\n  self.refundee = payable(msg.sender);\\n\\n  GMXTypes.AddLiquidityParams memory _alp;\\n\\n  _alp.tokenAAmt = self.tokenA.balanceOf(address(this));\\n  _alp.tokenBAmt = self.tokenB.balanceOf(address(this));\\n  _alp.executionFee = msg.value;\\n\\n  GMXManager.addLiquidity(\\n    self,\\n    _alp\\n  );\\n}\\n```\\n\\nTherefore, MEV bots could take advantage of the protocol's emergency situation and as these trades include all funds of the vault it could lead to a big loss.\\nIgnoring slippage when pausing could be a design choice of the protocol to avoid the possibility of a revert and pause the system as quickly as possible. However, this argument does not apply during the resume.

Impact:
Big loss of funds as all funds of the strategy vault are unprotected against MEV bots.

Recommended mitigation:
Implement a custom minMarketTokens parameter, but do not implement the usual slippage calculation, as this could potentially lead to new critical vulnerabilities. If for example the reason for this emergency situation is a no longer supported chainlink feed, which will lead to reverts and therefore also to DoS of the emergency close / withdraw flow.