# Unable to redeem from Notional

Redeemer.sol's maxRedeem only returns the contract's PT balance without calling Notional's redeem, so users can never redeem PT from Notional through Redeemer.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: dipp
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/341
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** Redeemer.sol ERC4626 wrapper over Notional wfCash
**Root cause:** The maxRedeem view function returns balanceOf(owner) of the Redeemer contract but never invokes Notional's redeem, so the redemption path is a no-op and PT stays locked in the contract.
**Steps:**
1. Call `maxRedeem(owner)` on Redeemer.sol; it returns `balanceOf(owner)` of the Redeemer contract.
2. Observe no call to Notional's `redeem(shares,...)` is made with that amount.
3. User's PT remains unredeemed in Redeemer.sol; funds stuck.
**How found:** Code review of Redeemer.sol's maxRedeem against Notional's wfCashERC4626 implementation, noticing maxRedeem is a pure balance view with no redeem call.
**Insight:** When auditing ERC4626 wrappers, verify that maxRedeem/maxWithdraw actually trigger the underlying protocol's redeem/withdraw; a view-only balance return silently strands funds.