# Illuminate's PT doesn't respect users' slippage specifications

ERC5095 withdraw/redeem hardcodes a 1% slippage cap instead of the user's requested minimum, letting users lose principal on pre-maturity PT sales.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/114
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** ERC5095 principal token withdraw/redeem via Marketplace.sellPrincipalToken
**Root cause:** withdraw()/redeem() pass `a - (a/100)` as the slippage cap to sellPrincipalToken instead of the user-specified minimum, hardcoding 1% extra slippage on top of the user's request.
**Steps:**
1. User calls ERC5095.withdraw(assets, receiver, owner, maxShares) pre-maturity expecting `assets` out.
2. Contract computes shares and calls `IMarketPlace.sellPrincipalToken(underlying, maturity, shares, Cast.u128(a - (a/100)))`.
3. The 4th arg is a 1% slippage cap, not the user's requested minimum, so the AMM swap can return up to 1% less than requested.
4. User receives less underlying than specified; if PT was minted from external PT, part of principal is lost.
**How found:** Code review of ERC5095.withdraw/redeem against NatSpec stating it should send back the specified amount; noticed the slippage argument was computed as `a - a/100` rather than the user's input.
**Exploitation:** MEV/sandwich attacker moves the YieldSpace AMM price within the 1% tolerance window during the user's withdraw/redeem, capturing the difference; user eats slippage beyond their spec.
**Insight:** When a function takes a user-supplied amount and forwards it to an AMM, check whether the slippage/min-out parameter is derived from user input or hardcoded; a fixed percentage cap silently overrides user protection.