Vulnerability: Lenders lose interests and pay deposit fees due to no slippage control
Severity: medium

Description:
When a lender deposits quote tokens below the minimum of LUP(Lowest Utilization Price) and HTP(Highest Threshold Price), the deposits will not earn interest and will also be charged deposit fees, according to docs. When a lender deposits to a bucket, they are vulnerable to pool LUP slippage which might cause them to lose funds due to fee charges against their will.\\nA lender would call `addQuoteToken()` to deposit. This function only allows entering expiration time for transaction settlement, but there is no slippage protection.\\n```\\n//Pool.sol\\n    function addQuoteToken(\\n        uint256 amount_,\\n        uint256 index_,\\n        uint256 expiry_\\n    ) external override nonReentrant returns (uint256 bucketLP_) {\\n        _revertAfterExpiry(expiry_);\\n        PoolState memory poolState = _accruePoolInterest();\\n        // round to token precision\\n        amount_ = _roundToScale(amount_, poolState.quoteTokenScale);\\n        uint256 newLup;\\n        (bucketLP_, newLup) = LenderActions.addQuoteToken(\\n            buckets,\\n            deposits,\\n            poolState,\\n            AddQuoteParams({\\n                amount: amount_,\\n                index:  index_\\n            })\\n        );\\n       // rest of code\\n```\\n\\nIn LenderActions.sol, `addQuoteToken()` takes current `DepositsState` in storage and current `poolState_.debt` in storage to calculate spot LUP prior to deposit. And this LUP is compared with user input bucket `index_` to determine if the lender will be punished with deposit fees. The deposit amount is then written to storage.\\n```\\n//LenderActions.sol\\n    function addQuoteToken(\\n        mapping(uint256 => Bucket) storage buckets_,\\n        DepositsState storage deposits_,\\n        PoolState calldata poolState_,\\n        AddQuoteParams calldata params_\\n    ) external returns (uint256 bucketLP_, uint256 lup_) {\\n  // rest of code\\n          // charge unutilized deposit fee where appropriate\\n |>       uint256 lupIndex = Deposits.findIndexOfSum(deposits_, poolState_.debt);\\n        bool depositBelowLup = lupIndex != 0 && params_.index > lupIndex;\\n        if (depositBelowLup) {\\n            addedAmount = Maths.wmul(addedAmount, Maths.WAD - _depositFeeRate(poolState_.rate));\\n        }\\n// rest of code\\n   Deposits.unscaledAdd(deposits_, params_.index, unscaledAmount);\\n// rest of code\\n```\\n\\nIt should be noted that current `deposits_` and `poolState_.debt` can be different from when the user invoked the transaction, which will result in a different LUP spot price unforeseen by the lender to determine deposit fees. Even though lenders can input a reasonable expiration time `expirty_`, this will only prevent stale transactions to be executed and not offer any slippage control.\\nWhen there are many lenders depositing around the same time, LUP spot price can be increased and if the user transaction settles after a whale lender which moves the LUP spot price up significantly, the user might get accidentally punished for depositing below LUP. Or there could also be malicious lenders trying to ensure their transactions settle at a favorable LUP/HTP and front-run the user transaction, in which case the user transaction might still settle after the malicious lender and potentially get charged for fees.

Impact:
Lenders might get charged deposit fees due to slippage against their will with or without MEV attacks, lenders might also lose on interest by depositing below HTP.

Recommended mitigation:
Add slippage protection in Pool.sol `addQuoteToken()`. A lender can enable slippage protection, which will enable comparing deposit `index_` with `lupIndex` in LenderActions.sol.