# Users can mint free Illuminate PTs if underlying decimals don't match external PTs

Lender.mint credited Illuminate PTs 1:1 from external PTs without decimal normalization, letting users mint inflated free PTs when decimals differ.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/120
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Lender.mint() principal token minting
**Root cause:** mint() transfers external PTs and authMints an equal amount of Illuminate PTs without converting for decimal differences between the external PT and the underlying asset.
**Steps:**
1. Identify an external PT (Swivel 18-dec, Pendle yield-token decimals, Notional 8-dec) whose decimals differ from the underlying.
2. Call `Lender.mint(p, u, m, a)` with a small amount `a` of that external PT.
3. Observe `authMint(msg.sender, a)` mints `a` Illuminate PTs 1:1, ignoring decimal scaling.
4. Repeat to inflate Illuminate PT supply and dilute value.
**How found:** Code review of mint() noting no decimal conversion between external PT input and Illuminate PT output, cross-checked against Swivel/Pendle/Notional decimal behaviors.
**Exploitation:** Attacker supplies external PTs with fewer decimals than the underlying; each unit mints one Illuminate PT of the underlying's decimals, inflating holdings and diluting existing PT value.
**Insight:** When a protocol accepts multiple external tokenized representations, check whether mint/redeem paths normalize decimals per-adapter; 1:1 accounting across heterogeneous decimal tokens is a classic inflation vector.