Yearn token <> shares conversion decimal issue

[code423n4]

Handle

cmichel

Vulnerability details

The yearn strategy YearnYield converts shares to tokens by doing pricePerFullShare * shares / 1e18:

function getTokensForShares(uint256 shares, address asset) public view override returns (uint256 amount) {
    if (shares == 0) return 0;
    // @audit should divided by vaultDecimals 
    amount = IyVault(liquidityToken[asset]).getPricePerFullShare().mul(shares).div(1e18);
}

But Yearn's getPricePerFullShare seems to be in vault.decimals() precision, i.e., it should convert it as pricePerFullShare * shares / (10 ** vault.decimals()).
The vault decimals are the same as the underlying token decimals

Impact

The token and shares conversions do not work correctly for underlying tokens that do not have 18 decimals.
Too much or too little might be paid out leading to a loss for either the protocol or user.

Recommended Mitigation Steps

Divide by 10**vault.decimals() instead of 1e18 in getTokensForShares.
Apply a similar fix in getSharesForTokens.