# A user can lose more value than he specifies in the spread when he enters a PowerFarm

On Arbitrum, PowerFarm entry applies the allowed spread to the Uniswap swap minimum, then reuses that reduced deposit as the baseline, letting users lose more than the spread permits.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: nonseodion
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** PendlePowerFarmLeverageLogic.sol (PowerFarm entry/exit logic)
**Root cause:** On Arbitrum the ENTRY_ASSET is swapped via UniswapV3 with a minimum output already scaled by reverseAllowedSpread, overwriting _depositAmount; ethValueBefore is then computed from this reduced amount, so the final spread check compares against the minimum rather than the original deposit.
**Steps:**
1. User enters PowerFarm with $1000 WBTC and allowedSpread=105% (reverseAllowedSpread=95%).
2. On Arbitrum, `_getTokensUniV3(_depositAmount, _getEthInTokens(ENTRY_ASSET,_depositAmount)*95/100, WETH, ENTRY_ASSET)` sets `_depositAmount` to as low as $950.
3. `ethValueBefore = _getTokensInETH(ENTRY_ASSET, _depositAmount)` now uses the reduced $950.
4. `ethValueAfter` is scaled by `_allowedSpread/1e18` and compared to `ethValueBefore`; passing allows final value as low as ~$904.76, exceeding the intended $950 floor.
**How found:** Code reading of the Arbitrum branch: noticed `_depositAmount` is reassigned to the swap's minimum output, then reused to compute `ethValueBefore`, and that `ethValueAfter` is scaled up rather than `ethValueBefore` scaled down, double-applying the spread.
**Exploitation:** User (or MEV/sandwiching) can push the Uniswap swap to the minimum allowed by the spread; the double-applied spread lets the position end below the user's stated minimum, causing up to ~$45 loss per $1000 versus the intended floor.
**Insight:** When a slippage/spread guard is applied to a swap minimum and the same variable is later reused as the 'before' baseline, the guard is applied twice; check whether the pre-swap amount is preserved for post-trade comparisons.