Submitted by dipp, also found by 0x1f8b, bardamu, Chom, datapunk, Alex the Entreprenerd, GimelSec, hyh, jah, kenzo, kirk-baird, Kumpa, ladboy233, Metatron, oyc109, shenwilly, simon135, unforgiven, and zer0dot_
Lender.sol#L192-L235
Lender.sol#L486-L534
Lender.sol#L545-L589
Some of the lend functions do not validate addresses sent as input which could lead to a malicous user being able to mint more PT tokens than they should.
Functions affect:
In the Illuminate and Yield lend function:
In the Sense lend function:
In the APWine lend function:
Consider validating the input addresses of y, x and pool through a whitelisting procedure if possible or validating that the returned amounts correspond with the amount of PT gained from the protocols by checking the balance before and after the PTs are gained and checking the difference is equal to returned.
sourabhmarathe (Illuminate) confirmed
