# Able to mint any amount of PT

Illuminate Lender.lend trusts caller-supplied AMM/pool addresses, letting a malicious contract return arbitrary amounts and mint unlimited PT tokens.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: dipp
- Disclosed: 2022-08-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/349
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:accounting-error

**Target:** Lender.sol lend functions (Illuminate/Yield, Sense, APWine)
**Root cause:** lend functions accept caller-supplied pool/AMM addresses (y, x, pool) without whitelisting; the returned PT amount from these untrusted contracts is used directly in mint.
**Steps:**
1. Deploy malicious contract implementing IYield/ISense/IAPWineRouter returning arbitrary `returned` values
2. Call `lend` with the malicious contract as `y`/`x`/`pool` and any small underlying amount `a`
3. `base`/`maturity` checks pass since malicious contract controls return values
4. `yield`/`swapUnderlyingForPTs`/`swapExactAmountIn` returns attacker-chosen `returned`
5. `mint` mints `returned` PT to attacker, disproportionate to underlying sent
**How found:** Code review of lend functions noting pool/AMM address inputs are not validated and their return values feed directly into mint.
**Exploitation:** Attacker supplies a malicious AMM contract as the pool argument, sends minimal underlying, and the contract returns an inflated amount that Lender mints as PT, yielding unlimited principal tokens.
**Insight:** In lending/minting routers that accept external AMM addresses, check whether the pool address is whitelisted and whether minted amounts are verified against actual balance deltas rather than trusting the external call's return value.