yixxas - Rewards are updated wrongly if collateral is not 18 decimals

[sherlock-admin]

yixxas

high

Rewards are updated wrongly if collateral is not 18 decimals

Summary

The calculation of tauEarned in updateReward is incorrect when collateral used is not 18 decimals. This can critically break the protocol.

Vulnerability Detail

This is how _tauEarned is calculated in updateReward

uint256 _rewardDiff = cumulativeTauRewardPerCollateral - userDetails[_account].lastUpdatedRewardPerCollateral
uint256 _tauEarned = (_rewardDiff * _userCollateral) / Constants.PRECISION

_rewardDiff is calculated based on the cumulativeTauRewardPerCollateral. Since TAU is 18 decimals, _rewardDiff is 18 decimals. Constants.PRECISION is 18 decimals as well, and hence the resulting computation of _tauEarned will be based on the number of decimals of _userCollateral.

However, correct decimals for _tauEarned should be 18 as TAU token is 18 decimals. Subsequent computations based on either an inflated or deflated value of _tauEarned will break the protocol.

Impact

Protocol cannot function correctly if collateral used is not 18 decimals.

Code Snippet

https://github.com/sherlock-audit/2023-03-taurus/blob/main/taurus-contracts/contracts/Vault/BaseVault.sol#L90

Tool used

Manual Review

Recommendation

Consider dividing by number of decimals of collateral instead of Constants.PRECISION

- uint256 _tauEarned = (_rewardDiff * _userCollateral) / Constants.PRECISION
+ uint256 _tauEarned = (_rewardDiff * _userCollateral) / 10 ** decimals()

Duplicate of #35