# Lender: no check for paused market on mint

Lender.mint lacks a paused-market check, letting an attacker mint iPTs from worthless principal tokens of an insolvent paused market and drain legitimate users' underlying.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: kenzo
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/260
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-09
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Lender.sol mint function
**Root cause:** Lender.mint does not verify the supplied market is not paused, so the pause/insolvency protection is bypassed.
**Steps:**
1. Market P becomes insolvent and is paused by Illuminate.
2. P principal tokens trade cheaply due to insolvency.
3. Attacker buys many worthless P principal tokens.
4. Attacker calls `Lender.mint` with market P, minting iPTs.
5. Attacker redeems iPTs for underlying owed to legitimate users.
**How found:** Code review of Lender.mint noting absence of a paused-market check, then reasoning about insolvency scenario where pause is meant to stop new bad debt.
**Exploitation:** Attacker acquires devalued principal tokens of a paused insolvent market cheaply, mints iPTs via Lender.mint (no pause check), and redeems them for underlying that should back legitimate users, creating bad debt.
**Insight:** When a protocol adds a pause/emergency-stop mechanism, audit every entry point that creates claims or debt (mint, deposit, borrow) for the missing pause check—one unchecked mint path nullifies the whole protection.