# Protocol fees not taken on premium

Illuminate's Swivel lend() path computes fee only on order amount, not on premium balance change, letting users avoid protocol fees.

- Payout: Contest reward
- Severity: medium
- Program: Illuminate
- Credited: IllIllI
- Disclosed: 2023-01-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-illuminate-judging/issues/22
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-illuminate%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Lender.sol lend() Swivel order path
**Root cause:** Fee is computed from swivelAmount(a) before order execution, while premium is the post-execution balance delta minus fee; no fee is charged on that premium when swapping or minting iPTs.
**Steps:**
1. Call Swivel version of `lend()` with orders where fee portion is small and premium non-fee portion is large
2. Observe `fee = lent / feenominator` computed only on `swivelAmount(a)`
3. Observe `premium = balanceOf(this) - starting - fee` excludes premium from fee base
4. Swap premium in yield pool or mint iPTs directly; no fee taken on premium
**How found:** Code reading of fee calculation: noticed fee derived from order amount while premium is post-execution balance delta, and that premium is never fee-charged; linked to prior contest finding whose fix only removed fee from premium, not fee on premium.
**Exploitation:** User routes lending through Swivel lend() instead of Illuminate lend(), structuring orders so most value arrives as premium rather than order amount, avoiding the protocol fee on that premium.
**Insight:** When a fee is computed from a pre-execution input but value actually received is a post-execution balance delta, check whether the delta (positive slippage/premium) escapes the fee base; also check sibling entrypoints that share logic but skip the fee.