# Lender#lend for Sense has mismatched decimals

Sense principal tokens use 8 decimals vs 6-decimal ERC5095 vault shares, so Lender#lend mints ~100x shares on USDC market, stealing yield from other users.

- Payout: Contest reward
- Severity: high
- Program: Illuminate
- Credited: 0x52
- Disclosed: 2022-10-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/164
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Lender#lend Sense adapter (ERC5095 vault minting)
**Root cause:** Lender#lend mints vault shares equal to the raw count of Sense principal tokens received, but Sense PTs (8 decimals) and the ERC5095 vault (6 decimals for USDC) have mismatched decimals, so no scaling is applied.
**Steps:**
1. Call `Lender#lend` with the USDC market and Sense adapter.
2. Contract swaps `lent` USDC for Sense PTs via `swapUnderlyingForPTs`, receiving ~1e8 PTs per 1e6 USDC.
3. `received = token.balanceOf(this) - starting` yields ~100x the correct share count.
4. `IERC5095(principalToken(u,m)).authMint(msg.sender, received)` mints ~100x vault shares to attacker.
5. Attacker holds inflated share of pro-rata yield, diluting all other depositors.
**How found:** Code review of Lender#lend's Sense branch: noticed mint amount derived directly from raw PT balance delta without decimal normalization, then compared Sense PT decimals (8, matching cTokens) against ERC5095 vault decimals (matching underlying, 6 for USDC).
**Exploitation:** Attacker deposits USDC through the Sense adapter path; the decimal mismatch mints ~100x the vault shares owed, granting a disproportionate claim on the vault's yield and diluting other holders.
**Insight:** When a lending adapter mints shares based on a token balance delta, verify the decimals of the received token match the share token; cToken-pegged PTs (8 decimals) frequently diverge from underlying-denominated vaults.