# User could lose underlying tokens when redeeming from the IdleYieldSource

IdleYieldSource.redeemToken passed redeemedShare instead of redeemAmount to redeemIdleToken, so redeemers received fewer underlying tokens than owed.

- Payout: Audit contest
- Severity: high
- Program: PoolTogether
- Found by: shw
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-pooltogether-findings/issues/120
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-pooltogether%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** IdleYieldSource.sol redeemToken (yield source contract)
**Root cause:** redeemToken calls Idle's redeemIdleToken with redeemedShare (the share amount burned) instead of redeemAmount (the underlying amount owed). Since tokenPriceWithFee() > ONE_IDLE_TOKEN, redeemedShare < redeemAmount, so fewer underlying tokens are redeemed than the user is owed.
**Steps:**
1. Read IdleYieldSource.redeemToken; note line 130 burns shares using `redeemedShare` (correct).
2. Note line 131 calls `redeemIdleToken(redeemedShare)` instead of `redeemIdleToken(redeemAmount)`.
3. Observe tokenPriceWithFee() > ONE_IDLE_TOKEN implies redeemedShare < redeemAmount, so the user receives less underlying than expected.
4. Fix: replace `redeemedShare` with `redeemAmount` at L131.
**How found:** Code review of redeemToken comparing the share-burn argument against the underlying-redeem argument; spotted the mismatched variable passed to redeemIdleToken.
**Exploitation:** Any user calling redeemToken receives fewer underlying tokens than their shares are worth; the shortfall stays in the yield source. No attacker capital or special preconditions described.
**Insight:** When a redeem function both burns shares and withdraws underlying, verify each external call receives the unit it expects (shares vs assets); a share/asset unit mismatch silently underpays users whenever price per share > 1.