# Swapping 100 tokens in DepositReceipt_ETH and DepositReciept_USDC breaks usage of WBTC LP and other high value tokens

DepositReceipt contracts hardcode a 100-token swap for LP pricing, making WBTC and other high-value LP tokens revert on slippage and trapping funds or blocking liquidation.

- Payout: Contest reward
- Severity: high
- Program: Isomorph
- Credited: 0x52
- Disclosed: 2022-11-05
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AH-9
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** DepositReceipt_ETH / DepositReceipt_USDC LP pricing via Velodrome router
**Root cause:** LP collateral is priced by swapping a fixed HUNDRED_TOKENS amount through the router; for high-value or low-liquidity tokens this swap exceeds available liquidity and reverts on slippage, so pricing (and thus every vault action) fails.
**Steps:**
1. Deposit WBTC/USDC LP into Vault_Velo; DepositReceipt calls router.getAmountOut(HUNDRED_TOKENS, token1, USDC) to price it.
2. Observe the 100-token swap reverts due to slippage since 100 WBTC far exceeds pool liquidity.
3. Any vault action (deposit, withdraw, liquidation) that calls priceLiquidity/totalCollateralValue reverts.
4. Alternatively: deposit large LP, borrow against a portion, withdraw remaining LP so 100-token swap no longer clears 5% slippage, making position unliquidatable.
**How found:** Code review of the pricing function noticed the hardcoded HUNDRED_TOKENS swap and reasoned that 100 WBTC (and even 100 WETH at ~11% slippage) cannot clear the router's slippage check, breaking pricing for high-value tokens.
**Exploitation:** Attacker deposits large WBTC/USDC LP collateral, borrows against part of it, then withdraws the rest of their LP. With liquidity reduced, the hardcoded 100-token swap reverts, so liquidation calls fail and the loan becomes risk-free.
**Escalation:** Reducing pool liquidity after borrowing blocks liquidation entirely, converting a pricing bug into protocol bad debt.
**Insight:** When a contract prices collateral by simulating a swap, check whether the probe size is fixed and whether it scales with token value/decimals; a constant probe can be larger than pool depth for high-value assets, and an attacker can shrink liquidity post-borrow to make liquidation revert.