# Lender.mint() May Take The Illuminate PT As Input Which Will Transfer And Mint More Illuminate PT Cause an Infinite Supply

Lender.mint() with p=0 lets caller pass Illuminate PT as principal, transferring it in and minting an equal amount back, repeatable to inflate supply.

- Payout: Contest reward
- Severity: medium
- Program: Illuminate
- Credited: kirk-baird
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Lender.mint() in Illuminate lending contract
**Root cause:** mint() derives principal from markets(u,m,p); when p=0 principal equals principalToken(u,m), so the contract transfers in the same token it then mints back 1:1.
**Steps:**
1. Call `Lender.lend()` with `p = 0` to obtain Illuminate principal tokens
2. `token.approve(Lender, amount)` to allow Lender to spend them
3. Loop: call `Lender.mint(0, u, m, a)` — transfers `a` Illuminate PT in, mints `a` Illuminate PT to msg.sender
4. Repeat indefinitely; surplus balance accumulates in Lender
**How found:** Code reading of mint(): noticed principal is fetched from markets(u,m,p) and p=0 maps to the Illuminate PT itself, making the transfer-in and mint-out the same asset.
**Exploitation:** Attacker repeatedly calls mint with p=0, cycling the same Illuminate PT through transferFrom and mint to inflate balance held by Lender; extra tokens not directly withdrawn but consumable by contracts approved via approve() (e.g. Redeemer).
**Insight:** When a function both pulls a token and mints a token, check whether the input token can equal the output token (self-referential principal); a p/index parameter selecting the protocol's own PT enables circular minting.