# SwapFarm converts wrapped tokens to assets incorrectly

SwapFarm's convertToAssets divides wrapped token amount by the USD/wrapToken oracle rate instead of multiplying, inverting conversions and breaking all wrap/unwrap slippage checks.

- Payout: Contest reward
- Severity: high
- Program: infiniFi
- Credited: trachev
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.1.7
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** SwapFarm convertToAssets oracle conversion
**Root cause:** convertToAssets divides _wrapTokenAmount by wrapTokenOracle.price(), but the oracle returns USD/Token, so the conversion should multiply; the reciprocal yields wrong asset amounts.
**Steps:**
1. Read SwapFarm.convertToAssets: `return _wrapTokenAmount.divWadDown(wrapTokenToAssetRate)` where rate = `IOracle(wrapTokenOracle).price()`.
2. Confirm oracle convention elsewhere in protocol: price is USD/Token.
3. Deposit assetTokens, wrap into wrapTokens, then attempt unwrap; conversion returns reciprocal (e.g. rate 1/2 yields 2 instead of 0.5).
4. Observe wrap/unwrap reverts on slippage validation due to incorrect asset amount.
**How found:** Code review comparing convertToAssets math against the protocol-wide oracle convention (USD/Token), spotting the division where multiplication was expected.
**Exploitation:** Not a direct theft path described; incorrect conversion causes wrapping/unwrapping to always revert when slippage checks run, breaking farm functionality (DoS of swap flows).
**Insight:** When a protocol has a single oracle price convention, audit every consumer of that oracle for multiply-vs-divide direction; a reciprocal bug silently inverts conversions and surfaces as slippage reverts.