Submitted by cccz, also found by 0x52 and datapunk
The depositAndFix function of the TempusController contract returns two uint256 data, the first is the number of shares exchanged for the underlying token, the second is the number of principalToken exchanged for the shares, the second return value should be used in the lend function for tempus.
This will cause the contract to mint an incorrect number of illuminateTokens to the user.
https://github.com/code-423n4/2022-06-illuminate/blob/92cbb0724e594ce025d6b6ed050d3548a38c264b/lender/Lender.sol#L452-L453
https://github.com/tempus-finance/tempus-protocol/blob/master/contracts/TempusController.sol#L52-L76
interfaces.sol
Lender.sol
sourabhmarathe (Illuminate) confirmed
