Fees should be paid by the user when lend() to Swivel

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L247-L305

Vulnerability details

function lend(
    uint8 p,
    address u,
    uint256 m,
    uint256[] memory a,
    address y,
    Swivel.Order[] calldata o,
    Swivel.Components[] calldata s
) public unpaused(p) returns (uint256) {

    // lent represents the number of underlying tokens lent
    uint256 lent;
    {
        // returned represents the number of underlying tokens to lend to yield
        uint256 returned;

        uint256 totalFee;
        // iterate through each order a calculate the total lent and returned
        for (uint256 i = 0; i < o.length; ) {
            Swivel.Order memory order = o[i];
            // Require the Swivel order provided matches the underlying and maturity market provided
            if (order.underlying != u) {
                revert NotEqual('underlying');
            } else if (order.maturity > m) {
                revert NotEqual('maturity');
            }

            {
                uint256 amount = a[i];
                // Determine the fee
                uint256 fee = calculateFee(amount);
                // Track accumulated fees
                totalFee += fee;
                // Amount lent for this order
                uint256 amountLent = amount - fee;
                // Sum the total amount lent to Swivel (amount of ERC5095 tokens to mint) minus fees
                lent += amountLent;
                // Sum the total amount of premium paid from Swivel (amount of underlying to lend to yield)
                returned += amountLent * order.premium / order.principal;
            }

            unchecked {
                i++;
            }
        }
    
        // Track accumulated fee
        fees[u] += totalFee;

        // transfer underlying tokens from user to illuminate
        Safe.transferFrom(IERC20(u), msg.sender, address(this), lent);
        // fill the orders on swivel protocol
        ISwivel(swivelAddr).initiate(o, a, s);

        yield(u, y, returned, address(this));
    }
    emit Lend(p, u, m, lent);
    return lent;
}

L297, lent is the amount of underlyingToken transferFrom user's wallet.

However, lent is the sum of amounts without the fees, see L275-583.

This means the user wont be paying for the fees when they lend() to Swivel.

Recommendation

Change to:

fees[u] += totalFee;

// transfer underlying tokens from user to illuminate
Safe.transferFrom(IERC20(u), msg.sender, address(this), lent + totalFee);
// fill the orders on swivel protocol
ISwivel(swivelAddr).initiate(o, a, s);

[KenzoAgada]

Duplicate of #201