# YieldSharing::targetIlliquidRatio might have double the intended effect

YieldSharing applies the bonding reward multiplier after clamping locked tokens to targetIlliquidRatio, doubling the ratio's effect and overpaying locked holders at the expense of iUSD stakers.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: phil
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.26
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.26
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** YieldSharing yield distribution contract (_handlePositiveYield)
**Root cause:** _handlePositiveYield clamps lockingReceiptTokens up to targetIlliquidMinimum before multiplying by bondingMultiplier (1e18-2e18), so the multiplier scales the already-inflated floor rather than the actual locked balance.
**Steps:**
1. Read `_handlePositiveYield()` in YieldSharing.
2. Note `lockingReceiptTokens = LockingController.totalBalance()` then clamped to `targetIlliquidMinimum = totalSupply * targetIlliquidRatio`.
3. Observe `lockingReceiptTokens = lockingReceiptTokens.mulWadDown(bondingMultiplier)` applied after the clamp.
4. When locked balance < target, the floor is multiplied by up to 2e18, inflating locked-holder share in `totalReceiptTokens`.
5. Compare against intended: multiplier should apply to actual balance before comparing to target.
**How found:** Code review of the yield distribution math: noticed the ordering of the clamp-to-target step versus the bondingMultiplier multiplication, and reasoned that the multiplier (1e18-2e18) applied post-clamp doubles the target ratio's effect.
**Insight:** When a protocol clamps a value to a target floor and then applies a variable multiplier, check the ordering: multiplying after the clamp scales the floor itself, so the effective target drifts with the multiplier range.