shaka - TAU currentMinted amount is not updated when tokens are burned from vault

[sherlock-admin]

shaka

medium

TAU currentMinted amount is not updated when tokens are burned from vault

Summary

TAU currentMinted amount is not updated when tokens are burned from vault.

Vulnerability Detail

BaseVault.sol burns TAU tokens of users when their debt is repaid or their position is liquidated. This is done by calling TAU.burnFrom(). As the documentation states, this call is supposed to decrease the burner's currentMinted amount if the burner is a vault. However, this is not the case.

TAU._decreaseCurrentMinted() checks that the currentMinted account is equal to or larger than the amount burned, but it incorrectly uses the currentMinted amount for the account whose tokens are being burned (user), instead of the currentMinted amount for the burner (vault). Thus, accountMinted will be zero and the currentMinted amount will never decrease.

function _decreaseCurrentMinted(address account, uint256 amount) internal virtual {
    // If the burner is a vault, subtract burnt TAU from its currentMinted.
    // This has a few highly unimportant edge cases which can generally be rectified by increasing the relevant vault's mintLimit.
    uint256 accountMinted = currentMinted[account]; // 👈 should be currentMinted[msg.sender]
    if (accountMinted >= amount) {
        currentMinted[msg.sender] = accountMinted - amount;
    }
}

Impact

Burning TAU via debt repayments or liquidations will not have the effect of reducing the currentMinted amount of vaults. Governance will be forced to permanently adjust the mint limit for each vault or give it a very high value to compensate for the lack of automatic readjustment, invalidating in practice the utility of this safety feature.

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/TAU.sol#L60-L83

Tool used

Manual Review

Recommendation

-- uint256 accountMinted = currentMinted[account];
++ uint256 accountMinted = currentMinted[msg.sender];

Duplicate of #149