# PendlePowerFarmToken:: totalLpAssetsToDistribute may lead to temporary DOS due to price growth check being skipped during deposit

Donating rewards to PendlePowerFarmToken inflates totalLpAssetsToDistribute, tripping the share-price growth check and temporarily freezing all deposits/withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: NentoR
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/123
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** PendlePowerFarmToken share-price growth validation
**Root cause:** addCompoundRewards() increases totalLpAssetsToDistribute but the syncSupply modifier validates share price before rewards are distributed, so the post-call _validateSharePriceGrowth check sees an inflated price and reverts.
**Steps:**
1. Alice deposits 1.3e18 LP via `depositExactAmount(1.3e18)`
2. Bob calls `addCompoundRewards(2e18)` donating LP, inflating totalLpAssetsToDistribute
3. After 1 second, Charlie's `depositExactAmount(1e18)` reverts with InvalidSharePriceGrowth
4. Alice's `withdrawExactShares(1e18)` also reverts
5. Reverts persist ~17 weeks until maximum catches up to _sharePriceNow
**How found:** Code reading of the syncSupply modifier ordering: noticed _validateSharePriceGrowth runs after the body but rewards added in addCompoundRewards are not yet reflected in share price at validation time, causing a mismatch that reverts subsequent calls.
**Exploitation:** Attacker donates LP tokens via addCompoundRewards (or exchangeRewardsForCompoundingWithIncentive), pushing share price above the time-based maximum; all syncSupply-gated functions revert until enough time elapses, freezing user funds. Cost grows with supply.
**Insight:** When a modifier validates state after the function body, check whether the body mutates inputs the validator depends on but doesn't immediately reflect—donation-style functions can desync the check from the actual price.