# Users can loose their Illuminate tokens if amount to redeem is greater than holdings[u][m]

Redeemer.redeem burns a user's Illuminate PTs but pays zero underlying when holdings[u][m] is zero, causing silent fund loss.

- Payout: Contest reward
- Severity: medium
- Program: Illuminate
- Credited: neumo
- Disclosed: 2022-10-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/81
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Redeemer.sol redeem/autoRedeem/authRedeem
**Root cause:** Redeemed amount is computed as (amount * holdings[u][m]) / pt.totalSupply(), but authBurn burns the full `amount` regardless; if holdings is zero or less than the proportional share, the user burns tokens for zero/less underlying.
**Steps:**
1. Deploy market for USDC/maturity via deployMarket.
2. User approves Lender and calls `l.mint(Yield, USDC, maturity, 1000)` to wrap 1000 Yield PTs into 1000 Illuminate PTs; holdings[USDC][maturity] stays 0.
3. User calls `r.redeem(USDC, maturity)` before any protocol redeem populates holdings.
4. `redeemed = (amount * holdings) / totalSupply` = 0, but `token.authBurn(msg.sender, amount)` burns all Illuminate PTs.
5. User receives 0 USDC; tokens lost.
**How found:** Code review of Redeemer.sol: noticed holdings is only incremented in protocol-specific redeem functions but decremented elsewhere, and that authBurn uses `amount` while payout uses proportional `redeemed`; wrote a Forge fork test to confirm zero payout.
**Exploitation:** Any user who mints Illuminate PTs by wrapping external PTs and redeems before holdings is populated loses their entire principal; no attacker needed, loss is self-inflicted via normal flow.
**Escalation:** Generalizes: if holdings[u][m] < totalSupply, redeemed < amount but full amount is burned, so partial loss occurs even when holdings is nonzero.
**Insight:** When a burn/transfer uses the raw input amount but payout uses a proportional formula, check for divergence between the two quantities; also check whether accounting state (holdings) can be zero while user balances are positive.