# Tempus lend method wrongly calculates amount of iPT tokens to mint

Tempus lend() subtracts the contract's iPT balance from a void return value, minting 0 iPT or reverting, so lenders receive no principal tokens.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: kenzo
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Lender.sol Tempus lend method
**Root cause:** depositAndFix returns nothing (void), so the subtraction yields 0 or underflows; the code conflates Tempus principal received with the contract's iPT balance, which are unrelated.
**Steps:**
1. Call Lender.lend with a Tempus pool adapter.
2. lend invokes ITempus.depositAndFix(...) which returns no value.
3. Expression `depositAndFix(...) - illuminateToken.balanceOf(address(this))` evaluates to 0 minus balance.
4. If iPT balance > 0 the subtraction underflows and reverts; if 0, returned=0 and mint(msg.sender, 0) mints nothing.
**How found:** Code reading: noticed depositAndFix has no return value on Etherscan, and that the subtracted iPT balance has no relation to Tempus principal tokens.
**Exploitation:** Any user calling lend against a Tempus pool receives zero iPT (or the call reverts when the contract holds iPT), denying them the principal tokens they should have received.
**Insight:** When a function's return value is used in arithmetic, verify the callee actually returns a value; also check that the two operands in a delta calculation measure the same asset (here Tempus principal vs iPT).