mstpr-brainbot - Mislogic on TAU contracts

[sherlock-admin]

mstpr-brainbot

high

Mislogic on TAU contracts

Summary

TAU contracts currentMinted mapping is not achieving the correct behaviour it should

Vulnerability Detail

When liquidator bot liquidates the position by an external call, TAU will be used on liquidator bots internal balance. So enough TAU needs to be there inside the liquidaton bot contract. However, when vault liquidates, it does this https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Vault/BaseVault.sol#L376

Now let’s examine the burnFrom function in the TAU contract. burnFrom will call the internal function _decreaseCurrentMinted with inputs as : address account = liquidator bot contract, 
amount = repaid debt

inside the _decreaseCurrentMinted function we see that accountMinted is checking the currentMinted[account] which is the current minted TAU to liquidator bot contract and can only be increment via mint(). Then inside the if check it does this:
currentMinted[msg.sender] = accountMinted - amoun t

here msg.sender is the vault itself and accountMinted is the total TAU minted via mint() function to liquidator bot. Accounting here is completely wrong since we are updating the currentMinted TAU balance of the vault with the liquidators balance. Also, if the liquidator bots currentMinted is 0 or below the “amount” this function will always revert so that liquidations will not be possible although the liquidator bot contract has sufficient TAU.

Another thing is that, airdropping TAU tokens to liquidator bot contract can’t solve this. currentMinted is only increased for the msg.sender of the mint() function which means liquidator bot needs to call the mint() function itself. Since there are no ways of liquidator bot to call mint() in TAU contract, _decreaseCurrentMinted function is completely missing the currentMinted accounting since every time it goes here https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/TAU.sol#L80
0 >= Some amount, it always returns false and not updates the currentMinted variable for the vault as intended.

That also means, if some time in future Taurus decides to make the liquidations public, liquidators must receive the TAU via mint() function.


That also means, when users repay their debt, vaults currentMinted variable is not decrementing aswell.

Impact

Code Snippet

Tool used

Manual Review

Recommendation

Duplicate of #149