The design defect of the ActivePool rehypothecation mechanism, ReaperVaultV2 administrators have too much authority and have the conditions and motives to do evil, so make users lack trust in the ETHOS system (crisis of trust)
Audit: 2023-02-ethos-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Core/contracts/ActivePool.sol#L280
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Core/contracts/ActivePool.sol#L282
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L321
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L324
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L372
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L404-L407
https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Core/contracts/ActivePool.sol#L278-L283


# Vulnerability details

## Impact

In the design logic of the current system, ActivePool holds all the collaterals of active troves and deposits part of them in ReaperVaultV2 for re-mortgaging. If the `deposit` and `withdraw` functions of ReaperVaultV2 revert,
Core functions such as borrowing (openTrove) of the ETHOS system, adjusting one’s own ICR (addColl/withdrawColl/withdrawLUSD/repayLUSD), redemption, liquidation and other core functions will be reverted at the same time, making these functions unavailable.
Once it cannot be redeemed/liquidated, it will affect the value of the stable currency LUSD/ERN and cannot target the US dollar, **which will cause a domino-style collapse of the system**.

Because the ReaperVaultV2 administrator has too much authority, if the ReaperVaultV2 administrator wants to do evil, he will be able to do it easily, such as:
1. The administrator sets ReaperVaultV2 into emergency mode, so that the deposit function of the ReaperVaultV2 contract will always generate revert, code link: `https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts /ReaperVaultV2.sol#L321`.
2. The administrator lowers the tvlCap value of the ReaperVaultV2 contract to cause a "Vault is full" error, so that the deposit function of the ReaperVaultV2 contract will always generate revert. Code link: `https://github.com/code-423n4/2023-02-ethos /blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L324`.
3. The administrator sets the `withdrawalQueue` array long enough by calling the setWithdrawalQueue function, so that the for loop of the widthdraw function will run out of gas and generate revert, so that the withdraw function of the ReaperVaultV2 contract will always generate revert. Code link: `https://github.com /code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L372`.
4. The administrator sets the `withdrawMaxLoss` value of the ReaperVaultV2 contract to