# The lend function for tempus uses the wrong return value of depositAndFix

Illuminate's Tempus lend path used the wrong return value from depositAndFix, minting incorrect amounts of illuminateTokens to users.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: cccz
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Lender.sol Tempus lend function / TempusController.depositAndFix
**Root cause:** depositAndFix returns (shares, principalTokens); the lend function consumed the first return value (shares) instead of the second (principalToken amount), so the minted illuminateToken quantity was computed from the wrong number.
**Steps:**
1. Read TempusController.depositAndFix: returns (uint256 shares, uint256 principalTokens).
2. In Lender.sol lend for tempus, call `ITempus(tempusAddr).depositAndFix(Any(x), Any(t), a - fee, true, r, d)` and capture the first return value.
3. Observe the minted illuminateToken amount derives from shares rather than principalTokens, producing an incorrect mint.
4. Fix: capture `(,uint256 returned)` and subtract prior illuminateToken balance before minting.
**How found:** Code review of the external TempusController interface return signature versus how Lender.sol consumed the return value.
**Exploitation:** Not described beyond incorrect minting of illuminateTokens to the user; no concrete drain sequence given.
**Insight:** When integrating external protocols, verify the tuple ordering of multi-value returns against the actual implementation; a plausible-looking first return value (shares) can silently differ from the accounting unit (principal tokens) your contract mints against.