# APWine Incorrect Check of Delegations Bugfix Review

APWine PT burn skipped the delegation check because to==address(0), letting attackers inflate FYT delegations and steal protocol yield.

- Payout: $100,000
- Severity: critical
- Program: APWine
- Credited: setuid0
- Disclosed: 2022-02-08
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/apwine-incorrect-check-of-delegations-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-apwine-incorrect-check-of-delegations-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** PT ERC20 token / FutureVault smart contract
**Root cause:** beforeTokenTransfer() guards the delegation-balance check with to != address(0), so during PT.burnFrom() (to=address(0)) the check that PT balance >= withdraw amount + delegated amount is skipped, leaving totalDelegationsReceived inflated.
**Steps:**
1. Deposit IBTs into FutureVault via `deposit` from a fresh account
2. Call `createFYTDelegationTo(attacker)` from that fresh account so totalDelegationsReceived[attacker] is credited
3. Call `withdraw` to redeem PTs for IBTs; `PT.burnFrom` runs `_beforeTokenTransfer(account, address(0), amount)` and skips the delegation check, so PTs return while delegation stays
4. Repeat steps 1-3 across multiple fresh accounts to inflate totalDelegationsReceived[attacker]
5. Wait several periods for inflated delegation to accrue FYT yield
6. Mint PTs/FYTs from the inflated delegation and call `withdraw` to redeem IBTs
**How found:** Code review of PT token's beforeTokenTransfer() hook: noticed the delegation-balance require was nested under a `to != address(0)` guard, and that ERC20 burn calls the hook with to=address(0), so the check is silently skipped on burnFrom during withdraw.
**Exploitation:** Attacker deposits IBTs, delegates FYT generation to self, then withdraws to recover principal while the delegation record persists. Repeating across fresh accounts inflates totalDelegationsReceived[attacker]; after ~6 months of periods the inflated delegation mints excess FYT/PT which are redeemed for IBTs, draining yield owed to legitimate depositors.
**Escalation:** Repeated across many fresh accounts to scale the inflated delegation and maximize stolen yield over multiple periods.
**Insight:** In ERC20 hook-based accounting, any require gated on `to != address(0)` is bypassed by burn paths (and `from != address(0)` by mint paths); check whether invariant checks live inside such guards and whether burn/mint can desync stored accounting like delegation totals.