jonatascm - Incorrect calculation of the max liquidation

[sherlock-admin]

jonatascm

high

Incorrect calculation of the max liquidation

Summary

The function _getMaxliquidation() is calculating incorrectly maximum to repay when collateral and debt have different decimals.

Vulnerability Detail

Calculating the maximum liquidation does not taking into account the collateral and debt decimals.

POC

In the case of collateral is a token with different decimals than 18, example 6 decimals and debit is TAU (decimals 18):

If Alice borrowed some tokens and now the price of collateral dropped, the calculation of amount to repay in getMaxLiquidation() :

/*
Consider:
_debt = 100 * 1e18
_collateral = 120 * 1e18
_price = 0.8e18
_decimals = 1e18
_liquidationDiscount = 1.2e18 (maximum value)
MAX_LIQ_COLL_RATION = 1.3e18
*/
maxRepay = ((MAX_LIQ_COLL_RATIO * _debt) - ((_collateral * _price * Constants.PRECISION) / (10 ** _decimals))) / (MAX_LIQ_COLL_RATIO - _liquidationDiscount);

//The simplifying the calculation
maxRepay =  [(130e36) - (96.8e24)] / (0.1e18) ~= 1299e18

//Considering the collateral and debt decimals the calculation would be
maxRepay = [(130e32) - (96e32)] / 0.1e18 = 340e18 

Impact

The users could be forced to repay all debt because of miss calculating of max liquidation

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus-jonatascm/tree/main/taurus-contracts/contracts/Vault/BaseVault.sol#L240-L261

function _getMaxLiquidation(
  uint256 _collateral,
  uint256 _debt,
  uint256 _price,
  uint8 _decimals,
  uint256 _liquidationDiscount
) internal pure returns (uint256 maxRepay) {
  // Formula to find the liquidation amount is as follows
  // [(collateral * price) - (liqDiscount * liqAmount)] / (debt - liqAmount) = max liq ratio
  // Therefore
  // liqAmount = [(max liq ratio * debt) - (collateral * price)] / (max liq ratio - liqDiscount)
  maxRepay =
      ((MAX_LIQ_COLL_RATIO * _debt) - ((_collateral * _price * Constants.PRECISION) / (10 ** _decimals))) /
      (MAX_LIQ_COLL_RATIO - _liquidationDiscount);
	...
}

Tool used

Manual Review

Recommendation

It's recommended to cache and use the collateral decimals and debt decimals in the account:

function _getMaxLiquidation(
  uint256 _collateral,
+ uint256 _collDecimals,
  uint256 _debt,
+ uint256 _debtDecimals,
  uint256 _price,
  uint8 _decimals,
  uint256 _liquidationDiscount
) internal pure returns (uint256 maxRepay) {
	...
-  maxRepay =
-      ((MAX_LIQ_COLL_RATIO * _debt) - ((_collateral * _price * Constants.PRECISION) / (10 ** _decimals))) /
-      (MAX_LIQ_COLL_RATIO - _liquidationDiscount);
+	maxRepay =
+      (((MAX_LIQ_COLL_RATIO * _debt * Constants.PRECISION)/ (10**_debtDecimals)) - ((_collateral * _price * Constants.PRECISION * Constants.PRECISION) / (10 ** _decimals * 10 ** _collDecimals))) /
+      (MAX_LIQ_COLL_RATIO - _liquidationDiscount);
	...
}

Duplicate of #35