duc - Wrong calculation of collateral ratio with the collateral tokens which are not in decimals 18

[sherlock-admin]

duc

medium

Wrong calculation of collateral ratio with the collateral tokens which are not in decimals 18

Summary

Wrong calculation of collateral ratio with the collateral tokens which has decimals < 18

Vulnerability Detail

Function _computeCR in library TauMath is used to calculate the collateral ratio of an account. But the formula in this function will be incorrect if collateral tokens has decimals != 18.

uint256 newCollRatio = (_coll * _price * Constants.PRECISION) / (_debt * 10 ** priceDecimals);

TAU token is the debt token, which is in 18 decimals. But the collateral can be not in decimals 18, example WBTC is in 8 decimals. Then this formula will calculate incorrectly the ratio for these token, since the decimals of token is not mentioned.
Example:

• Token WBTC is in 8 decimals, and the Oracle is Chainlink WBTC-USD, which has priceDecimals = 8
• Assume price of 1 WBTC is 20000$, it means price = 20000 * 1e8
• The collRatio of 1 WBTC (1e8 wei) and 1 TAU debt (1e18 wei) is:

(_coll * _price * Constants.PRECISION) / (_debt * 10 ** priceDecimals)
= 1e8 * (20000 * 1e8) * 1e18 / (1e18 * 1e8)
= 20000 * 1e8

• It's very small ratio of Constants.PRECISION (1e18), and it's incorrect since WBTC is very expensive.

There is a similar problem when convert debt asset (TAU tokens) to collateral in function _calcLiquidation of contract BaseVault.sol:

uint256 collateralToLiquidateWithoutDiscount = (_debtToLiquidate * (10 ** decimals)) / price;

Impact

Collateral tokens which has < 18 decimals (like WBTC) can't be supported. It's very bad behavior since the sponsors confirm that Taurus was built having in mind to support any collateral tokens.

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Libs/TauMath.sol#L18
https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Vault/BaseVault.sol#L406

Tool used

Manual review

Recommendation

Convert collateral amount to decimals 18 before calculation.

Duplicate of #35