# Not minting iPTs for lenders in several lend functions

Illuminate Lender's Swivel, Element, and yield lend functions transfer lender funds but never mint iPTs back, causing lender fund loss.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: Metatron
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/391
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AH-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Lender.sol lend functions (Swivel, Element, yield)
**Root cause:** Several lend functions transfer the lender's principal to the external PT but never mint the corresponding Illuminate PTs to the lender, so the lender receives nothing in return.
**Steps:**
1. Call `lend` for Swivel (Lender.sol L247-305) or Element (L317-367) with lender funds
2. Observe funds transferred out but no iPT minted to msg.sender
3. For the yield lend path (L227-234), comment says 'Purchase illuminate PTs directly to msg.sender' but only yield PTs are sent, no iPTs minted
**How found:** Code review of the lend functions comparing them against other lend implementations that correctly mint iPTs; noticed missing mint calls and a comment contradicting actual behavior.
**Exploitation:** Any lender using these lend functions loses their deposited funds since no iPTs are minted back to them; lending via these external PTs is effectively unusable and funds are stranded.
**Insight:** When a contract has multiple parallel lend/swap paths, diff each against the canonical one for missing mint/accounting calls; comments claiming an action ('purchase iPTs to msg.sender') that the code doesn't perform are strong bug signals.