# A malicious user can make the yield negative, preventing users from redeeming their iUSD

Rounding in infiniFi YieldSharing.unaccruedYield lets a dust mint flip accrued yield negative, blocking iUSD redemptions.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: ZoA
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.10
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.10
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** YieldSharing / Accounting yield accrual contract
**Root cause:** unaccruedYield computes assets.divWadDown(receiptTokenPrice) - totalSupply; divWadDown rounds down, so when receiptTokenPrice carries dust, a tiny mint makes the difference negative.
**Steps:**
1. Set iUSD oracle price to 0.9999 USDC (`oracleIusd.setPrice(1e18 - 100)`)
2. Alice mints 500 USDC via gateway and creates a 4-epoch position
3. Simulate $10 profit via `farm1.mockProfit(10e6)` then call `yieldSharing.accrue()` so yield is exactly zero
4. Alice mints 1 wei of iUSD via `gateway.mint(alice, 1)`
5. Call `yieldSharing.unaccruedYield()`; result is negative dust, blocking redemptions
**How found:** Code review of unaccruedYield: noticed divWadDown rounds down and that receiptTokenPrice (USDC ~0.9999) accumulates dust from prior negative yield, hypothesizing a dust mint could push the difference negative.
**Exploitation:** Attacker mints minMintAmount (1 wei) of iUSD after yield is accrued to zero while receiptTokenPrice has dust; rounding down makes unaccruedYield negative, so normal users' redeem calls revert.
**Insight:** When a yield/accounting delta is computed as (assets/price) - supply with a rounding-down division, any price with dust plus a minimal mint can flip the sign; test sign-flip at 1-wei mint boundaries.