# wrong YAXIS estimates

Harvester.getEstimates used a WETH input amount against a YAXIS->WETH path, producing wrong slippage estimates that could revert harvests or enable sandwiching.

- Payout: Audit contest
- Severity: medium
- Program: yAxis
- Found by: cmichel
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/112
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Harvester.getEstimates / Uniswap router price estimation
**Root cause:** getEstimates computes a YAXIS->WETH path but feeds it a WETH-denominated fee amount, mixing the swap direction with the wrong input token/precision.
**Steps:**
1. Read `Harvester.getEstimates`: `_path[0]=manager.yaxis(); _path[1]=weth()`
2. Note `_fee = _estimatedWETH * treasuryFee / 100%` is a WETH-precision value
3. Call `_router.getAmountsOut(_fee, _path)` with WETH amount against YAXIS->WETH path
4. Observe returned `_estimatedYAXIS` is wrong; compare to actual WETH->YAXIS trade in `_payHarvestFees`
**How found:** Code review of the estimation helper: noticed the path was set to YAXIS->WETH while the input amount was a WETH-precision fee, a direction/precision mismatch.
**Exploitation:** Wrong `_estimatedYAXIS` is passed as min-amount slippage to `BaseStrategy._payHarvestFees`; if overestimated, harvest reverts; if underestimated, large slippage tolerance enables sandwiching of the harvest trade.
**Insight:** When auditing price-oracle/estimation helpers, verify the token path direction matches the denomination and precision of the input amount passed to getAmountsOut; a swapped path silently yields plausible-but-wrong numbers that feed slippage params.