# ERC777 transfer hooks can be used to bypass fees for markets that support Swivel

Swivel lend() charges fees only on order amount; ERC777 pre-transfer hook inflates contract balance so swivelLendPremium swaps large underlying fee-free.

- Payout: Contest reward
- Severity: medium
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2022-10-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-illuminate-judging/issues/104
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Lender.lend() Swivel path / swivelLendPremium
**Root cause:** Fees are computed only on swivelAmount(a) while the premium swapped via swivelLendPremium() is derived from the contract's balance delta and charged no fee; ERC777 pre-transfer hooks let a user inflate that balance.
**Steps:**
1. Submit a Swivel order adding 1 wei of Notional (ERC777) to a Swivel position.
2. Use the ERC777 pre-transfer hook to send a large amount of underlying to the Lender contract.
3. lend() computes fee = lent / feenominator on the tiny swivelAmount, contributing ~0 fee.
4. swivelLendPremium() swaps the inflated balance (premium) for Illuminate principal tokens with no fee charged.
**How found:** Code review of the Swivel branch of lend(): noticed fee is based on swivelAmount(a) while premium is computed from balance delta, and that Notional is an ERC777 proxy enabling balance manipulation via transfer hooks.
**Exploitation:** Attacker (or a deployed helper contract for novice users) routes large underlying through the ERC777 hook into Lender, then calls swivelLendPremium to convert it to principal tokens paying zero protocol fees.
**Insight:** When a fee is computed on a declared order amount but the actual swapped value comes from a balance delta, look for tokens with transfer hooks (ERC777) that let you inflate the delta outside the fee-bearing path.