peanuts - Protocol assumes that all future collateral will have 18 decimal places

[sherlock-admin]

peanuts

medium

Protocol assumes that all future collateral will have 18 decimal places

Summary

Protocol intends to have more yield bearing tokens as collateral in the future. However, if the yield bearing tokens do not have 18 decimal place, the collaterization ratio calculation not be calculated accurately.

Vulnerability Detail

TauMath.sol includes the function _computeCR() which computes the collaterization ratio of the user's collateral and debt. This collaterization ratio has a base of 1e18, with the minimum collaterization ratio set to 1.2e18. If the collateral has 6 decimal places, then the calculation of collaterization ratio will not work.

    function _computeCR(
        uint256 _coll,
        uint256 _debt,
        uint256 _price,
        uint8 priceDecimals
    ) internal pure returns (uint256) {
        if (_debt > 0) {
            uint256 newCollRatio = (_coll * _price * Constants.PRECISION) / (_debt * 10 ** priceDecimals);


            return newCollRatio;
        }

newCollRatio is calculated as such:

uint256 newCollRatio = (_coll * _price * Constants.PRECISION) / (_debt * 10 ** priceDecimals);

The decimals of _price and 10 ** priceDecimals will cancel out. The decimals of Constants.PRECISION and _debt will cancel out, leaving the decimals for _coll. If it is not in base 18, then newCollRatio will not work.

Imagine a new yield bearing token like zAAVE which is going for 200 USDC and has 6 decimal places. A user deposits 10 zAAVE and takes out a $1000 TAU debt.

Simply speaking, having $2000 worth of collateral and only withdrawing $1000 means a 200% collaterization ratio. In calculation format, assuming zAAVE has 18 decimals:

(10e18 * 200e6 * 1e18) / (1000e18 * 1e6) = 2e18 or 200% collaterization ratio.

Assuming zAAVE has 6 decimals now,

(10e6 * 200e6 * 1e18) / (1000e18 * 1e6) = 2e6.

This shows that a collateral with !18 decimal places will not work.

Impact

Collaterization ratio will be affected if future collateral is not 18 decimal places.

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Libs/TauMath.sol#L11-L21

Tool used

Manual Review

Recommendation

Recommend either checking the decimal place for all collaterals and anchoring them to 18 decimals accordingly or simply disallow collateral with non-18 decimal places.

Duplicate of #35