# Missing input validation for _rewardProportion parameter allows keeper to escalate his privileges and pay back all loans

Keeper-controlled _rewardProportion in Taurus SwapHandler.swapForTau lacked an upper bound, letting a keeper withhold near-max TAU and erase all user debt.

- Payout: Contest reward
- Severity: high
- Program: Taurus
- Credited: cducrest-brainbot
- Disclosed: 2023-02-08
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-taurus-judging/issues/11
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Solidity SwapHandler.swapForTau in Taurus vault contracts
**Root cause:** _rewardProportion is used to compute withheld TAU without validating it is <= PERCENT_PRECISION (1e18), so values above 100% distribute more TAU than was burnt.
**Steps:**
1. Keeper calls `SwapHandler.swapForTau` with a large `_rewardProportion` (e.g. near `type(uint256).max`)
2. Contract computes `_withholdTau((tauReturned * _rewardProportion) / Constants.PERCENT_PRECISION)`
3. Withheld TAU vastly exceeds burnt amount, zeroing user debt
4. Users withdraw collateral without repaying debt
**How found:** Code review of swapForTau: noticed _rewardProportion feeds directly into _withholdTau with no bound check, and reasoned any value >1e18 distributes more TAU than burnt, erasing debt.
**Exploitation:** A keeper (semi-trusted role limited to liquidations and yield swaps) passes an oversized _rewardProportion to swapForTau, causing _withholdTau to be called with a near-max value that erases all outstanding debt, letting users withdraw collateral debt-free and leaving TAU unbacked.
**Insight:** When a semi-trusted role supplies a proportion/percentage parameter, check whether it is bounded to PERCENT_PRECISION; unbounded multipliers feeding debt-reduction or balance-decrement logic let a low-privilege actor zero out accounting.