# Exiting a farm on mainnet assumes a peg of 1:1  when swapping stETH for ETH

Wise Lending's PowerFarm exit on mainnet prices stETH as WETH (1:1), so when stETH depegs the Curve swap minOut is too high and reverts, blocking farm exits.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: 0xStalin
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/304
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** PendlePowerFarmLeverageLogic.sol farm-exit swap (Curve stETH/ETH)
**Root cause:** When exiting a farm on mainnet, tokenOut is stETH but _getTokensInETH is called with WETH_ADDRESS, so the stETH amount is valued 1:1 as ETH; reverseAllowedSpread is then applied to that ETH value to derive _minOutAmount for the Curve stETH->ETH swap.
**Steps:**
1. On mainnet, call farm exit so _logicClosePosition sets `tokenOut = ST_ETH_ADDRESS`.
2. Observe `_getTokensInETH(WETH_ADDRESS, tokenOutAmount)` values stETH at the WETH/ETH price (1:1).
3. `_minOutAmount = ethValue * reverseAllowedSpread / PRECISION_FACTOR_E18` is computed from that 1:1 value.
4. `_getEthBack` -> `_swapStETHintoETH` calls `CURVE.exchange({fromIndex:1, toIndex:0, exactAmountFrom:_swapAmount, minReceiveAmount:_minOutAmount})`.
5. When stETH trades below ETH (e.g. 0.95), Curve can return at most ~0.95 ETH per stETH, below the 1:1-derived minOut, so the swap reverts and the exit fails.
**How found:** Code reading of the mainnet farm-exit path: noticed tokenOut is stETH but the price lookup uses WETH_ADDRESS, i.e. an implicit 1:1 peg assumption; cross-referenced historical stETH depeg (June 2022 ~0.93) and prior Asymmetry Finance findings on the same wstETH/stETH 1:1 assumption.
**Exploitation:** Not an attacker-driven exploit: a user exiting a farm during stETH depeg has the Curve swap revert because minReceiveAmount exceeds what the pool yields, blocking withdrawal/exit until peg recovers or params change.
**Insight:** In multi-chain exit logic, check whether the asset actually swapped (stETH) differs from the asset used for pricing (WETH); any LST/LRT priced via its peg asset inherits depeg revert risk in minOut computations.