# APWine PT redemptions can be blocked forever

Attacker sends 1 wei of APWine PTs to Lender after rollover, so Redeemer's full-balance withdrawal lacks matching FYTs and all APWine PT redemptions revert, freezing funds.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/109
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-14
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Redeemer.sol APWine withdrawal path
**Root cause:** Redeemer reads the Lender's entire PT balance and passes it to apwineWithdraw, which calls transferFYTs for that full amount; PTs donated after the rollover have no corresponding FYTs, so the transfer reverts.
**Steps:**
1. Before rollover, buy 1 wei of APWine PT for each market via open market.
2. After APWine rolls to the new period, transfer the 1 wei PT to the Lender contract.
3. Redeemer.redeem() reads `amount = IERC20(principal).balanceOf(cachedLender)` including the donated wei.
4. apwineWithdraw calls `ILender(lender).transferFYTs(fyt, a)` with a > available FYTs, reverting.
5. All APWine PT redemptions for that maturity/underlying fail; Illuminate PT holders receive less than lent.
**How found:** Code reading of Redeemer.redeem/apwineWithdraw: noticed the amount is derived from the Lender's live PT balance rather than the rolled amount, and reasoned that post-roll donations create PTs without matching FYTs.
**Exploitation:** Attacker spends 1 wei per market, buying PTs pre-roll and donating post-roll so the Lender's PT balance exceeds its FYT balance; every redemption of that market reverts. Attacker can additionally corner FYT supply on the open market to block the recommended manual unblock.
**Escalation:** Attacker can repeat cheaply across every APWine-backed market and buy up FYT supply to prevent recovery, converting a 1-wei grief into permanent lock of all principal.
**Insight:** When a redemption path derives its amount from a live token balance that anyone can inflate, check whether the paired token (FYT) is minted proportionally; unsolicited donations to shared contracts can brick full-balance withdrawals.