`STRATEGIST` still can assign a higher percentage into the `withdrawMaxLoss`, which may lead to a very higher risk for users to lose the principle sent as a collateral
Audit: 2023-02-ethos-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L41
https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L54-L55
https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L568


# Vulnerability details

## Impact
Within the ReaperVaultV2#`updateWithdrawMaxLoss()` above, the user who has a `STRATEGIST` role still can assign a higher percentage (i.e. 99% = 9999) into the `withdrawMaxLoss`.
This lead to a very higher risk for users to lose the principle sent as a collateral if something like a market crisis will happen.

## Proof of Concept
Within the ReaperVaultV2,
- the `PERCENT_DIVISOR` would be defined and `10000` (in BPS that means 100%) would be assigned as a initial value like this:
   https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L41
- the `withdrawMaxLoss` would be defined as a max slippage(loss) allowed when withdrawing and `1` in BPS (0.01%) would be assigned as a initial value like this:
  https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L54-L55
```solidity
    uint256 public constant PERCENT_DIVISOR = 10000;  /// @audit - This is in BPS that means 100%
    ...

    // Max slippage(loss) allowed when withdrawing, in BPS (0.01%)
    uint256 public withdrawMaxLoss = 1;
```

Within the ReaperVaultV2#`updateWithdrawMaxLoss()`,
there is the validation to check whether or not the `_withdrawMaxLoss` would be less than 100% (10000) like this:
https://github.com/code-423n4/2023-02-ethos/blob/main/Ethos-Vault/contracts/ReaperVaultV2.sol#L568
```solidity
    /**
     * @notice Updates the withdrawMaxLoss which is the maximum allowed slippage.
     * @param _withdrawMaxLoss The new value, in basis points.
     */
    function updateWithdrawMaxLoss(uint256 _withdrawMaxLoss) external {
        _atLeastRole(STRATEGIST);
        require(_withdrawMaxLoss <= PERCENT_DIVISOR, "Invalid BPS value");  /// @audit - This is the validation to check whether or not the `_withdrawMaxLoss` would be less than 100% (10000)
        withdrawMaxLoss = _withdrawMaxLoss;
        emit WithdrawMaxLossUpdated(_withdrawMaxLoss);
    }
```

According to the [documentation](https://docs.reaper.farm/ethos-reserve-bounty-hunter-documentation/#activepool-rehypothecation), a description that the vault will be farming the `lowest-risk` yield possible would be written like this:
> _he vault will be farming the lowest-risk yield possible, so you can assume that the principal will be protected from loss._

However, within the ReaperVaultV2#`updateWithdrawMaxLoss()` above, the user who has a `STRATEGIST` role still can assign a higher percentage (i.e. 99% = 9999) into the `withdrawMaxLoss` that is a max slippage(loss) allowed when withdrawing.
This lead to a very higher risk for users to lose the principle sent as a collateral if something like a market crisi