Function lend is not transfering in protocol fees

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L641-L654

Vulnerability details

The function lend is calculating the total sum of tokens lent to swivel, as well as summing up the fees totalFee

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L278-L297

                    // Track accumulated fees
                    totalFee += fee;
                    // Amount lent for this order
                    uint256 amountLent = amount - fee;
                    // Sum the total amount lent to Swivel (amount of ERC5095 tokens to mint) minus fees
                    lent += amountLent;
                    // Sum the total amount of premium paid from Swivel (amount of underlying to lend to yield)
                    returned += amountLent * order.premium / order.principal;
                }

                unchecked {
                    i++;
                }
            }
      
            // Track accumulated fee
            fees[u] += totalFee;

            // transfer underlying tokens from user to illuminate
            Safe.transferFrom(IERC20(u), msg.sender, address(this), lent);

However, when it comes to transferring in the underlying, only lent is transferred in.

Meaning that the contract will account for fees it didn't receive, breaking fees accounting for that token as well as unfairly making minting of the principal cheaper via this function call

Mitigation steps

Transfer in lent + totalFee

Change

Safe.transferFrom(IERC20(u), msg.sender, address(this), lent);

To

Safe.transferFrom(IERC20(u), msg.sender, address(this), lent + totalFee);

[KenzoAgada]

Duplicate of #201