# Illuminate redemptions don't account for protocol pauses/temporary blocklistings

Illuminate redeems Illuminate PTs against current holdings only, so paused external PTs leave unredeemed principal unclaimable and burned users lose funds.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: Jeiwan
- Disclosed: 2022-10-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/113
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-13
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Redeemer.sol / ERC5095.sol redemption logic
**Root cause:** Redemption payout is computed as amount * holdings[u][m] / totalSupply, where holdings only reflect already-redeemed external PTs; unredeemed external PTs contribute zero, and the user's PT is burned regardless.
**Steps:**
1. External PT (Pendle/Sense/Notional) is paused or temporarily blocked at Illuminate PT maturity.
2. Redeemer.redeem() cannot convert that external PT, so holdings[u][m] stays below full principal.
3. User calls ERC5095.redeem()/withdraw() or autoRedeem(); `redeemed = (amount * holdings[u][m]) / pt.totalSupply()` pays only the partial share.
4. `pt.authBurn(msg.sender, amount)` burns the full PT balance, forfeiting the unredeemed portion.
5. When the external PT later unpauses, remaining holders receive the principal that should have gone to the burned user.
**How found:** Code reading of Redeemer.redeem/authRedeem/autoRedeem and ERC5095.redeem: noticed holdings only increase on successful external redemption, while user redemption divides by totalSupply and burns the full balance, and that autoRedeem/authRedeem lack the unpaused modifier.
**Exploitation:** No attacker action required; a user redeeming while an external PT is paused permanently loses the unredeemed principal, which is redistributed to remaining holders.
**Insight:** In multi-protocol aggregators, check whether share-based redemption math uses a snapshot of realized holdings rather than pending external claims; any external dependency that can pause or block conversion turns into permanent user loss because the burn is unconditional.