mstpr-brainbot - Misaccounting Decimals

[sherlock-admin]

mstpr-brainbot

high

Misaccounting Decimals

Summary

_getCollPrice returned decimals assumes always 18 decimals

Vulnerability Detail

This function always returns the collateral ratio in 18 decimals. In a case where collateral tokens decimals is not 18 this function will not work as it intended.
https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Vault/BaseVault.sol#L190-L196

here the math for decimals is:
(collatDecimals + priceDecimals + 18) - (collatDecimals + priceDecimals) = 18, so it is fixed 18 no matter what you input because of the PRECISION.

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Libs/TauMath.sol#L11-L27

Example: Imagine collateral token is 6 decimals. Every time you try to check the health factor you will receive something up to 18 decimals so this function will always return you that you are way over your health factor because of misleading decimals.

Impact

Code Snippet

Tool used

Manual Review

Recommendation

Duplicate of #35