# User-supplied AMM pools and no input validation allows stealing of stEth protocol fees

Lender.lend trusts user-supplied underlying and AMM pool without matching them, letting an attacker swap stEth fees with zero slippage and sandwich them away.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/47
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Lender.lend AMM swap integration (APWine/Tempus/Sense/Illuminate/Swivel)
**Root cause:** lend() takes underlying asset and swap pool/adapter as independent user inputs and never verifies the pool actually trades the supplied underlying; swap paths use relative indices, not asset addresses.
**Steps:**
1. Attacker calls APWine lend with `u=DAI`, `a=100e18`, `r=0` (minAmountOut), and `pool` set to an stEth AMM pool.
2. lend pulls 100 DAI from attacker and computes fee, then calls `IAPWineRouter(x).swapExactAmountIn(pool, apwinePairPath(), apwineTokenPath(), lent, r, address(this), d, address(0))`.
3. Because `r=0` and pool is stEth, the swap executes against stEth with no slippage protection.
4. Attacker sandwiches the lend tx so Lender receives ~0 PTs while attacker captures the stEth swapped out.
**How found:** Code review of lend() noting swap parameters (pool, paths, minAmountOut) are all user-controlled and paths use relative indices 0/1 rather than asset addresses, so pool need not match underlying.
**Exploitation:** Attacker supplies cheap DAI as underlying but points the swap at the stEth pool with minAmountOut=0, then front-runs/back-runs the lend transaction to capture the stEth fees the protocol attempted to swap.
**Escalation:** Same pattern applies across Tempus (x pool), Sense (adapter), Illuminate (bypass Yield check by supplying Illuminate principal), and Swivel (order), broadening the attack surface.
**Insight:** When a contract accepts both an asset and a swap venue/path as user inputs, verify the venue's tokens actually match the asset; relative path indices (0/1) hide the real asset and enable swapping a different token than supplied.