WithdrawPeriphery#_convertToToken slippage control is broken for any token other than USDC
WithdrawPeriphery allows the user to redeem junior share vaults to any token available on GMX, applying a fixed slippage threshold to all redeems. The slippage calculation always returns the number of tokens to 6 decimals. This works fine for USDC but for other tokens like WETH or WBTC that are 18 decimals the slippage protection is completely ineffective and can lead to loss of funds for users that are withdrawing.\\n```\\nfunction _convertToToken(address token, address receiver) internal returns (uint256 amountOut) {\\n    // this value should be whatever glp is received by calling withdraw/redeem to junior vault\\n    uint256 outputGlp = fsGlp.balanceOf(address(this));\\n\\n    // using min price of glp because giving in glp\\n    uint256 glpPrice = _getGlpPrice(false);\\n\\n    // using max price of token because taking token out of gmx\\n    uint256 tokenPrice = gmxVault.getMaxPrice(token);\\n\\n    // apply slippage threshold on top of estimated output amount\\n    uint256 minTokenOut = outputGlp.mulDiv(glpPrice * (MAX_BPS - slippageThreshold), tokenPrice * MAX_BPS);\\n\\n    // will revert if atleast minTokenOut is not received\\n    amountOut = rewardRouter.unstakeAndRedeemGlp(address(token), outputGlp, minTokenOut, receiver);\\n}\\n```\\n\\nWithdrawPeriphery allows the user to redeem junior share vaults to any token available on GMX. To prevent users from losing large amounts of value to MEV the contract applies a fixed percentage slippage. minToken out is returned to 6 decimals regardless of the token being requested. This works for tokens with 6 decimals like USDC, but is completely ineffective for the majority of tokens that aren't.
Adjust minTokenOut to match the decimals of the token:\\n```\\n    uint256 minTokenOut = outputGlp.mulDiv(glpPrice * (MAX_BPS - slippageThreshold), tokenPrice * MAX_BPS);\\n+   minTokenOut = minTokenOut * 10 ** (token.decimals() - 6);\\n```\\n
Users withdrawing tokens other than USDC can suffer huge loss of funds due to virtually no slippage protection
```\\nfunction _convertToToken(address token, address receiver) internal returns (uint256 amountOut) {\\n    // this value should be whatever glp is received by calling withdraw/redeem to junior vault\\n    uint256 outputGlp = fsGlp.balanceOf(address(this));\\n\\n    // using min price of glp because giving in glp\\n    uint256 glpPrice = _getGlpPrice(false);\\n\\n    // using max price of token because taking token out of gmx\\n    uint256 tokenPrice = gmxVault.getMaxPrice(token);\\n\\n    // apply slippage threshold on top of estimated output amount\\n    uint256 minTokenOut = outputGlp.mulDiv(glpPrice * (MAX_BPS - slippageThreshold), tokenPrice * MAX_BPS);\\n\\n    // will revert if atleast minTokenOut is not received\\n    amountOut = rewardRouter.unstakeAndRedeemGlp(address(token), outputGlp, minTokenOut, receiver);\\n}\\n```\\n