# Farms with insufficient assets can be chosen for redemption, leading to reverts

infiniFi's optimal-farm selection uses assets() (total balance) instead of available liquidity, so it can pick a farm whose funds are utilized and revert on withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: samuraii77
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.19
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault redemption farm-selection logic (Aave aToken farm)
**Root cause:** Farm selection compares _amount against IFarm(farm).assets(), which for Aave returns aToken balance including utilized funds, not actual withdrawable liquidity.
**Steps:**
1. Observe redemption loop iterates _farms computing farmBalance = IFarm(farm).assets()
2. Note Aave farm's assets() returns ERC20(aToken).balanceOf(address(this)), counting utilized funds
3. Have a farm where balance >= _amount but liquidity < _amount
4. Selection picks that farm as targetIndex
5. Call IFarm(farm).withdraw(_assetAmountOut, msg.sender) reverts due to insufficient liquidity
**How found:** Code review of the optimal-farm selection loop; noticed assets() for the Aave farm returns aToken balance rather than available liquidity, so the liquidity check is wrong.
**Exploitation:** Not an attack; a user-triggered denial of redemption. When the chosen farm lacks liquid assets, withdraw reverts and the user cannot redeem or enter the redemption queue despite another farm having sufficient liquidity.
**Insight:** When selecting a source for withdrawal, compare against actual withdrawable liquidity (e.g. Aave liquidity()) not total balance—aToken/CToken balances include lent-out funds and will revert on withdrawal.