# `swapUnderlyingForYt` revert due to rounding issues

Napier Router's swapUnderlyingForYt rounds down uDeposit, minting fewer PT than flash-borrowed, so repayment check reverts and swaps fail.

- Payout: Contest reward
- Severity: medium
- Program: Napier
- Credited: xiaoming90
- Disclosed: 2024-01-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/101
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-9
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:precision-loss

**Target:** NapierRouter.swapUnderlyingForYt / Tranche.issue
**Root cause:** uDepositNoFee and uDeposit are computed with round-down division plus a 0.01bps buffer that is too small; the minted PT (issued) can be less than the flash-borrowed ytOutDesired, tripping RouterInsufficientPtRepay.
**Steps:**
1. Set cscale=1.2e18, maxScale=1.25e18, ytOutDesired=123, issuanceFee=0.
2. uDepositNoFee = 1.2e18*123/1.25e18 = 118 (round down).
3. uDeposit = 118*10000/(10000-1) = 118 (round down).
4. Flash-borrow 123 PT via swapPtForUnderlying.
5. Tranche.issue with 118 underlying mints shares=98, issued=98*1.25e18/1e18=122 PT.
6. swapCallback sees pyIssued(122) < pyDesired(123) and reverts RouterInsufficientPtRepay.
**How found:** Code-reading of the uDeposit formula and its 0.01bps buffer comment; manually traced the rounding through Tranche.issue share/PT math to show issued PT can fall short of the flash-loaned amount.
**Insight:** When a router flash-borrows an exact desired amount then repays from a mint whose output is rounded down twice (shares then PT), a tiny fee buffer cannot guarantee coverage; check the worst-case rounding chain, not just the fee term.