# If token does not oversell, users cannot claim tax refund on their tax free allocation.

TokenSale.claim() requires left>0, so users with tax-free allocation cannot claim tax refunds unless the token oversold.

- Payout: Contest reward
- Severity: high
- Program: Zap Protocol
- Credited: bughuntoor
- Disclosed: 2024-03-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zap-protocol-judging/issues/58
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zap-protocol%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** TokenSale.sol claim() function
**Root cause:** claim() requires `left > 0`, but `left` is only nonzero when totalPrivateSold exceeds totalSupplyInValue (oversold); otherwise _claim sets share=amount and left=0, reverting the refund path.
**Steps:**
1. User deposits USDC via _processPrivate, paying tax on full amount
2. Token sale does not oversell (totalPrivateSold <= totalSupplyInValue)
3. User calls `claim()`; _claim returns left=0
4. `require(left > 0, "TokenSale: Nothing to claim")` reverts, blocking tax refund
**How found:** Code reading of claim() and _claim(): noticed `left` is only assigned in the oversold branch, making the require check unreachable for non-oversold sales despite tax-free allocation logic.
**Insight:** When a refund/claim path shares a variable with a conditional branch, check whether that variable is ever populated on the non-branch path — a require on it silently disables the feature.