Swapping 100 tokens in DepositReceipt_ETH and DepositReciept_USDC breaks usage of WBTC LP and other high value tokens
DepositReceipt_ETH and DepositReciept_USDC checks the value of liquidity by swapping 100 tokens through the swap router. WBTC is a good example of a token that will likely never work as LP due to the massive value of swapping 100 WBTC. This makes DepositReceipt_ETH and DepositReciept_USDC revert during slippage checks after calculating amount out. As of the time of writing this, WETH also experiences a 11% slippage when trading 100 tokens. Since DepositReceipt_ETH only supports 18 decimal tokens, WETH/USDC would have to use DepositReciept_USDC, resulting in WETH/USDC being incompatible. The fluctuating liquidity could also make this a big issue as well. If liquidity reduces after deposits are made, user deposits could be permanently trapped.\\n```\\n    //check swap value of 100tokens to USDC to protect against flash loan attacks\\n    uint256 amountOut; //amount received by trade\\n    bool stablePool; //if the traded pool is stable or volatile.\\n    (amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\\n```\\n\\nThe above lines try to swap 100 tokens from token1 to USDC. In the case of WBTC 100 tokens is a monstrous amount to swap. Given the low liquidity on the network, it simply won't function due to slippage requirements.\\n```\\nfunction _priceCollateral(IDepositReceipt depositReceipt, uint256 _NFTId) internal view returns(uint256){  \\n    uint256 pooledTokens = depositReceipt.pooledTokens(_NFTId);      \\n    return( depositReceipt.priceLiquidity(pooledTokens));\\n}\\n\\nfunction totalCollateralValue(address _collateralAddress, address _owner) public view returns(uint256){\\n    NFTids memory userNFTs = loanNFTids[_collateralAddress][_owner];\\n    IDepositReceipt depositReceipt = IDepositReceipt(_collateralAddress);\\n    //slither-disable-next-line uninitialized-local-variables\\n    uint256 totalPooledTokens;\\n    for(uint256 i =0; i < NFT_LIMIT; i++){\\n        //check if each slot contains an NFT\\n        if (userNFTs.ids[i] != 0){\\n            totalPooledTokens += depositReceipt.pooledTokens(userNFTs.ids[i]);\\n        }\\n    }\\n    return(depositReceipt.priceLiquidity(totalPooledTokens));\\n}\\n```\\n\\nOne of the two functions above are used to price LP for every vault action on Vault_Velo. If liquidity is sufficient when user deposits but then drys up after, the users deposit would be permanently trapped in the in the vault. In addition to this liquidation would also become impossible causing the protocol to assume bad debt.\\nThis could also be exploited by a malicious user. First they deposit a large amount of collateral into the Velodrome WBTC/USDC pair. They take a portion of their LP and take a loan against it. Now they withdraw the rest of their LP. Since there is no longer enough liquidity to swap 100 tokens with 5% slippage, they are now safe from liquidation, allowing a risk free loan.
Change the number of tokens to an immutable, so that it can be set individually for each token. Optionally you can add checks (shown below) to make sure that the number of tokens being swapped will result in at least some minimum value of USDC is received. Similar changes should be made for DepositReceipt_ETH:\\n```\\nconstructor(string memory _name, \\n            string memory _symbol, \\n            address _router, \\n            address _token0,\\n            address _token1,\\n            uint256 _tokensToSwap,\\n            bool _stable,\\n            address _priceFeed) \\n            ERC721(_name, _symbol){\\n\\n    // rest of code\\n\\n    if (keccak256(token0Symbol) == keccak256(USDCSymbol)){\\n        require( IERC20Metadata(_token1).decimals() == 18, "Token does not have 18dp");\\n\\n+       (amountOut,) = _router.getAmountOut(_tokensToSwap, token1, USDC);\\n\\n+       //swapping tokens must yield at least 100 USDC\\n+       require( amountOut >= 1e8);\\n+       tokensToSwap = _tokensToSwap;\\n    }\\n    else\\n    {   \\n        bytes memory token1Symbol = abi.encodePacked(IERC20Metadata(_token1).symbol());\\n        require( keccak256(token1Symbol) == keccak256(USDCSymbol), "One token must be USDC");\\n        require( IERC20Metadata(_token0).decimals() == 18, "Token does not have 18dp");\\n        \\n+       (amountOut, ) = _router.getAmountOut(_tokensToSwap, token0, USDC);\\n\\n+       //swapping tokens must yield at least 100 USDC\\n+       require( amountOut >= 1e8);\\n+       tokensToSwap = _tokensToSwap;\\n    }\\n```\\n
LPs that contain high value tokens will be unusable at best and freeze user funds or be abused at the worst case
```\\n    //check swap value of 100tokens to USDC to protect against flash loan attacks\\n    uint256 amountOut; //amount received by trade\\n    bool stablePool; //if the traded pool is stable or volatile.\\n    (amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\\n```\\n