Malicious user can DOS pool and avoid liquidation by creating secondary liquidity pool for Velodrome token pair
For every Vault_Velo interaction the vault attempts to price the liquidity of the user. This calls priceLiquidity in the corresponding DepsoitReciept. The prices the underlying assets by swapping them through the Velodrome router. Velodrome can have both a stable and volatile pool for each asset pair. When calling the router directly it routes through the pool that gives the best price. In priceLiquidity the transaction will revert if the router routes through the wrong pool (i.e. trading the volatile pool instead of the stable pool). A malicious user can use this to their advantage to avoid being liquidated. They could manipulate the price of the opposite pool so that any call to liquidate them would route through the wrong pool and revert.\\n```\\n    uint256 amountOut; //amount received by trade\\n    bool stablePool; //if the traded pool is stable or volatile.\\n    (amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\\n    require(stablePool == stable, "pricing occuring through wrong pool" );\\n```\\n\\nDepositReceipt uses the getAmountOut call the estimate the amountOut. The router will return the best rate between the volatile and stable pool. If the wrong pool give the better rate then the transaction will revert. Since pricing is called during liquidation, a malicious user could manipulate the price of the wrong pool so that it returns the better rate and always reverts the liquidation call.
Instead of quoting from the router, query the correct pool directly:\\n```\\n        uint256 amountOut; //amount received by trade\\n-       bool stablePool; //if the traded pool is stable or volatile.\\n\\n-       (amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\\n-       require(stablePool == stable, "pricing occuring through wrong pool" );\\n+       address pair;\\n\\n+       pair = router.pairFor(token1, USDC, stable)\\n+       amountOut = IPair(pair).getAmountOut(HUNDRED_TOKENS, token1)\\n```\\n
Malicious user can avoid liquidation
```\\n    uint256 amountOut; //amount received by trade\\n    bool stablePool; //if the traded pool is stable or volatile.\\n    (amountOut, stablePool) = router.getAmountOut(HUNDRED_TOKENS, token1, USDC);\\n    require(stablePool == stable, "pricing occuring through wrong pool" );\\n```\\n