Submitted by KIntern_NA
https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/Market.sol#L415-L421 
https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/Market.sol#L390-L396
Actions of users (borrow, repay, removeCollateral, ) in Martket contract might be reverted by overflow, resulting in their funds might be frozen.
Function _isSolvent in Market contract use conversion from share to amount of yieldBox.
It will trigger _toAmount function in YieldBoxRebase contract
The calculation amount = (share * totalAmount) / totalShares_ might be overflow because
share * totalAmount = collateralShare * (EXCHANGE_RATE_PRECISION / FEE_PRECISION) * collateralizationRate * totalAmount
In the default condition,
EXCHANGE_RATE_PRECISION = 1e18,
FEE_PRECISION = 1e5,
collateralizationRate = 0.75e18
The collateralShare is equal to around 1e8 * collateralAmount by default (because totalAmount++; totalShares_ += 1e8; is present in the _toAmount function).
=> share * totalAmount ~= (collateralAmount * 1e8) * (1e18 / 1e5) * 0.75e18 * totalAmount = collateralAmount * totalAmount * 0.75e39
This formula will overflow when collateralAmount * totalAmount > 1.5e38. This situation can occur easily with 18-decimal collateral. As a consequence, user transactions will revert due to overflow, resulting in the freezing of market functionalities.
The same issue applies to the calculation of _computeMaxBorrowableAmount in the Market contract.
Reduce some variables used to trigger yieldBox.toAmount(), such as EXCHANGE_RATE_PRECISION and collateralizationRate, and use these variables to calculate with the obtained amount.
Example, the expected amount can be calculated as:
0xRektora (Tapioca) confirmed
