# Anyone can convert someone's unclaimed yield to PT + YT

Anyone can call Tranche.issue with to=victim and zero amount, forcibly converting the victim's unclaimed yield into PT+YT and charging an issuance fee.

- Payout: Contest reward
- Severity: medium
- Program: Napier
- Credited: KingNFT
- Disclosed: 2024-01-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/83
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Tranche.sol issue() on Napier v1
**Root cause:** issue() deletes unclaimedYields[to] and reinvests accrued interest into PT+YT for any caller-specified `to`, with no consent from or restriction on the recipient, and applies an issuance fee.
**Steps:**
1. Alice accumulates 100 Target Tokens as unclaimed yield in unclaimedYields[Alice].
2. Bob calls `Tranche.issue(to=Alice, underlyingAmount=0)`.
3. Line 196-197 sets lscales[Alice]=_maxscale and deletes unclaimedYields[Alice].
4. Accrued interest is computed from the deleted yield and minted as PT+YT to Alice (lines 217-224).
5. Issuance fee (issuanceFeeBps) is deducted, so Alice receives less value than collecting via collect().
**How found:** Code reading of issue(): noticed unclaimedYields[to] is cleared and reinvested for an arbitrary `to` without recipient consent, and that the reinvestment path charges a fee unlike collect().
**Exploitation:** Attacker calls issue() with the victim as `to` and zero underlying; victim's unclaimed yield is force-converted to PT+YT minus an issuance fee, causing guaranteed loss versus collecting yield directly.
**Insight:** In yield/interest-accrual contracts, check whether state-clearing functions (claim/collect/issue) accept an arbitrary beneficiary and mutate their stored yield; forced reinvestment paths that apply fees are a griefing vector even when no funds are stolen.