# Wrong use of nftID to check if a PowerFarm position is an Aave position

Wise Lending PowerFarm used WiseLending nftId instead of PowerFarm keyId to check isAave, breaking debt ratio, payback, and liquidation for Aave positions.

- Payout: Contest reward
- Severity: high
- Program: Wise Lending
- Credited: nonseodion
- Disclosed: 2024-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/32
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AH-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** PendlePowerFarm / PowerFarmManager smart contracts
**Root cause:** isAave mapping is keyed by PowerFarm keyId, but five call sites index it with the WiseLending nftId, so Aave positions are treated as non-Aave.
**Steps:**
1. Create an Aave PowerFarm position via `enterFarm(true, 1 ether, 15 ether, entrySpread)`; note `keyId` and `nftId = farmingKeys(keyId)`.
2. Call `getLiveDebtRatio(nftId)`; it reads `isAave[nftId]` (false) and returns 0 instead of the Aave debt ratio.
3. Call `manuallyPaybackShares(keyId, borrowShares)`; it selects WETH instead of aWETH and reverts with arithmetic underflow.
4. Make the position liquidatable (raise collateral factors), then call `liquidatePartiallyFromToken(nftId, nftIdLiquidator, borrowShares)`; `checkDebtRatio` uses wrong borrowShares and reverts with `DebtRatioTooLow`.
**How found:** Code reading: noticed isAave is written with keyId in PendlePowerManager but read with nftId at five sites, then wrote Foundry tests to confirm zero debt ratio, failed manual payback, and blocked liquidation.
**Exploitation:** A malicious user opens an Aave PowerFarm position, lets it become undercollateralized, and liquidators cannot liquidate because `_coreLiquidation` reverts in `checkDebtRatio` due to the wrong isAave lookup, leaving bad debt.
**Insight:** When a protocol maintains two linked identifiers (keyId vs nftId), grep every mapping read/write to confirm the same key domain is used; mismatches often silently disable liquidation or accounting paths.