# Leak of Value in yield function, slippage check is not effective

Illuminate's yield() passes sellBasePreview output straight to sellBase with no validation, so the slippage check is effectively zero and value leaks to MEV.

- Payout: Contest reward
- Severity: medium
- Program: Illuminate
- Credited: Alex the Entreprenerd
- Disclosed: 2022-08-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-illuminate-findings/issues/289
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-illuminate%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** Lender.sol yield() internal function / yield pool sellBase
**Root cause:** The `returned` value from `IYield.sellBasePreview` is used as the slippage parameter for `sellBase` without any validation (not checked for zero or a minimum fraction of `a`), so the check is equivalent to passing 0.
**Steps:**
1. Call `yield(u, y, a, r)`; it computes `returned = IYield(y).sellBasePreview(Cast.u128(a))`.
2. It transfers `a` of token `u` to yield pool `y`.
3. It calls `IYield(y).sellBase(r, returned)` using the unvalidated preview value as slippage bound.
4. Since `returned` is not validated, a sandwich/MEV attacker can move price so the swap executes at an arbitrarily worse rate.
**How found:** Code reading of the `yield` function: noticed `sellBasePreview` output is documented as an off-chain front-running aid but is passed on-chain with no validation, making the slippage check meaningless.
**Exploitation:** Attacker front-runs the yield pool swap to shift price, the unvalidated `returned` bound permits execution at the manipulated rate, and the attacker back-runs to capture the leaked value.
**Insight:** When a 'preview' function's output is documented for off-chain use but is consumed on-chain as a slippage/limit parameter, check whether any bound is enforced — an unvalidated preview is equivalent to zero slippage protection.