Anyone can convert someone's unclaimed yield to PT + YT
Anyone can convert someone's unclaimed yield to PT + YT, leading to a loss of assets for the victim.\\nAssume that Alice has accumulated 100 Target Tokens in her account's unclaimed yields. She is only interested in holding the Target token (e.g., she is might be long Target token). She intends to collect those Target Tokens sometime later.\\nBob could disrupt Alice's plan by calling `issue` function with the parameter (to=Alice, underlyingAmount=0). The function will convert all 100 Target Tokens stored within Alice's account's unclaimed yield to PT + YT and send them to her, which Alice does not want or need in the first place.\\nLine 196 below will clear Alice's entire unclaimed yield before computing the accrued interest at Line 203. The accrued interest will be used to mint the PT and YT (Refer to Line 217 and Line 224 below).\\n```\\nFile: Tranche.sol\\n    function issue(\\n        address to,\\n        uint256 underlyingAmount\\n    ) external nonReentrant whenNotPaused notExpired returns (uint256 issued) {\\n..SNIP..\\n        lscales[to] = _maxscale;\\n        delete unclaimedYields[to];\\n\\n        uint256 yBal = _yt.balanceOf(to);\\n        // If recipient has unclaimed interest, claim it and then reinvest it to issue more PT and YT.\\n        // Reminder: lscale is the last scale when the YT balance of the user was updated.\\n        if (_lscale != 0) {\\n            accruedInTarget += _computeAccruedInterestInTarget(_maxscale, _lscale, yBal);\\n        }\\n..SNIP..\\n        uint256 sharesUsed = sharesMinted + accruedInTarget;\\n        uint256 fee = sharesUsed.mulDivUp(issuanceFeeBps, MAX_BPS);\\n        issued = (sharesUsed - fee).mulWadDown(_maxscale);\\n\\n        // Accumulate issueance fee in units of target token\\n        issuanceFees += fee;\\n        // Mint PT and YT to user\\n        _mint(to, issued);\\n        _yt.mint(to, issued);\\n```\\n\\nThe market value of the PT + YT might be lower than the market value of the Target Token. In this case, Alice will lose due to Bob's malicious action.\\nAnother `issue` is that when Bob calls `issue` function on behalf of Alice's account, the unclaimed target tokens will be subjected to the issuance fee (See Line 218 above). Thus, even if the market value of PT + YT is exactly the same as that of the Target Token, Alice is still guaranteed to suffer a loss from Bob's malicious action.\\nIf Alice had collected the unclaimed yield via the collect function, she would have received the total value of the yield in the underlying asset terms, as a collection of yield is not subjected to any fee.
Consider not allowing anyone to issue PY+YT on behalf of someone's account.
Loss of assets for the victim.
```\\nFile: Tranche.sol\\n    function issue(\\n        address to,\\n        uint256 underlyingAmount\\n    ) external nonReentrant whenNotPaused notExpired returns (uint256 issued) {\\n..SNIP..\\n        lscales[to] = _maxscale;\\n        delete unclaimedYields[to];\\n\\n        uint256 yBal = _yt.balanceOf(to);\\n        // If recipient has unclaimed interest, claim it and then reinvest it to issue more PT and YT.\\n        // Reminder: lscale is the last scale when the YT balance of the user was updated.\\n        if (_lscale != 0) {\\n            accruedInTarget += _computeAccruedInterestInTarget(_maxscale, _lscale, yBal);\\n        }\\n..SNIP..\\n        uint256 sharesUsed = sharesMinted + accruedInTarget;\\n        uint256 fee = sharesUsed.mulDivUp(issuanceFeeBps, MAX_BPS);\\n        issued = (sharesUsed - fee).mulWadDown(_maxscale);\\n\\n        // Accumulate issueance fee in units of target token\\n        issuanceFees += fee;\\n        // Mint PT and YT to user\\n        _mint(to, issued);\\n        _yt.mint(to, issued);\\n```\\n