# YT holder are unable to claim their interest

Attacker mints minimal shares then donates large assets to inflate maxScale, locking YT holders' lscale so interest accrued is always zero.

- Payout: Contest reward
- Severity: high
- Program: Napier
- Credited: xiaoming90
- Disclosed: 2024-01-24
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/80
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** Tranche/Adaptor yield token interest accounting
**Root cause:** Interest accrued formula uses (1/lscale - 1/maxScale); maxScale is set to the highest observed scale and never decreases. An attacker can inflate maxScale via a donation, and since lscale for new minters is set to maxScale, interest is always zero.
**Steps:**
1. Immediately after Tranche/Adaptor deployment, mint the smallest possible shares via `prefundedDeposit` or `Tranche.issue`.
2. Transfer a large amount of assets directly to the Adaptor, making the scale extremely large (L).
3. Trigger any function that updates the global scale; maxScale becomes L and stays locked.
4. Withdraw all shares/assets via `prefundedDeposit` or redeem functions (no fees incurred).
5. Subsequent users minting PT/YT get lscale = maxScale = L; since scale never exceeds L, lscale stays L, so interestAccrued = y*(1/L - 1/L) = 0.
**How found:** Code review of interest formula and maxScale update logic; recognized that maxScale is monotonic and can be manipulated by donation, similar to inflation attack but specific to scale mechanism.
**Exploitation:** Attacker acts as first depositor, mints minimal shares, donates large assets to inflate scale, triggers maxScale update, then withdraws. Cost is low (no withdrawal fees). YT holders can never accrue interest because their lscale is stuck at the inflated maxScale.
**Insight:** In yield protocols, any global maximum or checkpoint variable that only increases can be manipulated by a first-depositor donation to permanently lock user-specific accumulators, causing zero accrual. Check if maxScale/lscale logic allows such griefing.