Submitted by kirk-baird, also found by csanuragjain, datapunk, and ladboy233
There is a division before multiplication bug that exists in lend() for the Swivel case.
If order.premium is less than order.principal then returned will round to zero due to the integer rounding.
When this occurs the users funds are essentially lost. That is because they transfer in the underlying tokens but the amount sent to yield(u, y, returned, address(this)) will be zero.
Specifically the function returned += (a[i] - fee) * (order.premium / order.principal);
The multiplication should occur before division, that is ((a[i] - fee) * order.premium) / order.principal);.
JTraversa (Illuminate) confirmed 
Alex the Entreprenerd (warden) commented:
