# Redeem Sense can be bricked

User-supplied Sense contract address in Redeemer.redeem lets attacker noop the redeem call, locking all principal in the contract permanently.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: kenzo
- Disclosed: 2022-08-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/244
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-07
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** Redeemer.sol redeem function (Sense market redemption)
**Root cause:** Redeemer trusts user-supplied `d` (Sense contract) address and only redeems the amount transferred from lender; a malicious `d` noops redeem, leaving principal stuck and subsequent redeems seeing zero balance.
**Steps:**
1. Attacker deploys malicious contract implementing ISense.redeem as a noop.
2. Attacker calls Redeemer.redeem with `d` = malicious contract, lender = victim lender.
3. Redeemer transfers lender's full principal balance to itself via Safe.transferFrom.
4. Redeemer calls `ISense(d).redeem(o, m, amount)` which does nothing.
5. Sense market is never redeemed; principal locked in Redeemer.
6. Any later redeem attempt reads amount=0 and redeems 0, permanently bricking the market.
**How found:** Code reading of Redeemer.redeem: noticed `d` is user-supplied and the redeem amount is derived from the lender's balance, so a fake `d` could absorb the transfer without redeeming.
**Exploitation:** Attacker supplies a noop ISense implementation as `d`; Redeemer pulls the lender's entire principal into itself then calls the fake redeem which does nothing, trapping funds and preventing any future redemption since the lender balance is now zero.
**Insight:** When a contract takes a user-supplied external contract address and derives amounts from a balance it just pulled, a noop implementation can strand funds and zero out the balance other callers depend on; check whether the target address is whitelisted or the amount is read from the real protocol.