# Sense PTs can never be redeemed

Illuminate's Redeemer never approves the Converter for Sense tokens, so redeeming Sense PTs always reverts, permanently locking underlying principal.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/117
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-11
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error

**Target:** Redeemer.sol redeem() / Converter approval
**Root cause:** Redeemer.redeem() calls IConverter.convert() for Sense PTs, but the Converter is never approved to pull the compounding token from Redeemer; the only approve() function is gated to marketPlace and cannot be called by admin.
**Steps:**
1. User lends/mints via Sense adapter, Redeemer holds Sense PTs
2. Call Redeemer.redeem() for Sense flavor: it calls ISenseDivider.redeem then IConverter.convert(compounding, u, balance)
3. convert() attempts transferFrom of compounding token from Redeemer, which has zero allowance to Converter
4. Call reverts every time; underlying stays locked in Redeemer
**How found:** Code review of Redeemer.redeem() Sense branch noting the IConverter.convert call requires prior approval; traced approve() and found it is authorized(marketPlace) only, so admin cannot grant it. Also noticed fork test used vm.startPrank to fake the approval, masking the bug.
**Exploitation:** Not an attacker-driven exploit; a functional flaw causing permanent freeze of Sense PT underlying. Users who redeem Illuminate PTs lose principal since underlying is stuck; only admin emergency withdraw() can rescue, breaking trustlessness.
**Insight:** When a contract calls a third-party converter/aggregator that pulls tokens via transferFrom, verify the allowance is actually granted on the calling contract and reachable by an authorized path; be suspicious of fork tests using vm.startPrank to set up approvals that production code never establishes.