imare - computing CR only works for collateral with 18 decimals value

[sherlock-admin]

imare

medium

computing CR only works for collateral with 18 decimals value

Summary

When calculating collateral ratio with TauMath#_computeCR method if we use a collateral with decimals larger then 18 we can get an arithmetic overflow.

Collateral ratio in the protocol is represented as an 18 decimal precision value but the calculation will be wrong if asset is not 18 decimal.

Vulnerability Detail

When calculating collateral ratio for a asset that has 30 decimals precession (for example GLPPriceOracle reports price as 30 decimal precision value) we get an arithmetic overflow in this line:

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Libs/TauMath.sol#L18

Impact

The current collateral ratio calculation is limited to asset that only supports 18 decimals

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Libs/TauMath.sol#L18

Tool used

Manual Review

Recommendation

When calculating the collateral ratio is recommend to scale up/down the collateral value and collateral price to 18 decimals before the calculation.

Duplicate of #35