Missing input validation for _rewardProportion parameter allows keeper to escalate his privileges and pay back all loans
They are also able to choose how much yield token to swap and what the proportion of the resulting TAU is that is distributed to users vs. not distributed in order to erase bad debt.\\nSo a `keeper` is not trusted to perform any actions that go beyond swapping yield / performing liquidations.\\nHowever there is a missing input validation for the `_rewardProportion` parameter in the `SwapHandler.swapForTau` function. This allows a keeper to "erase" all debt of users. So users can withdraw their collateral without paying any of the debt.\\nBy looking at the code we can see that `_rewardProportion` is used to determine the amount of `TAU` that `_withholdTau` is called with: Link\\n```\\n_withholdTau((tauReturned * _rewardProportion) / Constants.PERCENT_PRECISION);\\n```\\n\\nAny value of `_rewardProportion` greater than `1e18` means that more `TAU` will be distributed to users than has been burnt (aka erasing debt).\\nIt is easy to see how the `keeper` can chose the number so big that `_withholdTau` is called with a value close to `type(uint256).max` which will certainly be enough to erase all debt.
I discussed this issue with the sponsor and it is intended that the `keeper` role can freely chose the value of the `_rewardProportion` parameter within the `[0,1e18]` range, i.e. 0%-100%.\\nTherefore the fix is to simply check that `_rewardProportion` is not bigger than 1e18:\\n```\\ndiff --git a/taurus-contracts/contracts/Vault/SwapHandler.sol b/taurus-contracts/contracts/Vault/SwapHandler.sol\\nindex c04e3a4..ab5064b 100644\\n--- a/taurus-contracts/contracts/Vault/SwapHandler.sol\\n// Add the line below\\n// Add the line below\\n// Add the line below\\n b/taurus-contracts/contracts/Vault/SwapHandler.sol\\n@@ -59,6 // Add the line below\\n59,10 @@ abstract contract SwapHandler is FeeMapping, TauDripFeed {\\n             revert zeroAmount();\\n         }\\n \\n// Add the line below\\n        if (_rewardProportion > Constants.PERCENT_PRECISION) [\\n// Add the line below\\n            revert invalidRewardProportion();\\n// Add the line below\\n        ]\\n// Add the line below\\n\\n         // Get and validate swap adapter address\\n         address swapAdapterAddress = SwapAdapterRegistry(controller).swapAdapters(_swapAdapterHash);\\n         if (swapAdapterAddress == address(0)) {\\n```\\n
A `keeper` can escalate his privileges and erase all debt. This means that `TAU` will not be backed by any collateral anymore and will be worthless.
```\\n_withholdTau((tauReturned * _rewardProportion) / Constants.PERCENT_PRECISION);\\n```\\n