# Price movements between USDC and the underlying token in the pendle market can cause underflow errors and disallow further wraps

PendleV2Farm's yield interpolation subtracts totalWrappedAssets from an oracle-derived maturity amount; if the USDC/underlying rate drops, the subtraction underflows and blocks all further wraps.

- Payout: Contest reward
- Severity: medium
- Program: infiniFi
- Credited: samuraii77
- Disclosed: 2025-05-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinifi_april2025.pdf#3.2.20
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.20
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** PendleV2Farm wrap accounting / assetToPtUnderlyingOracle
**Root cause:** _interpolatingYield computes maturityAssetAmount from PT balance times oracle rate, then subtracts totalWrappedAssets and _alreadyInterpolatedYield; a lower oracle rate makes maturityAssetAmount smaller than the already-wrapped total, underflowing the uint subtraction.
**Steps:**
1. Deposit assets and wrap before maturity: `scenarioDepositAssetsAndWrapBeforeMaturity(1000e6, 0.25e18)`
2. Warp to midpoint between now and maturity: `vm.warp((ts + expiry) / 2)`
3. Wrap again: `scenarioDepositAssetsAndWrapBeforeMaturity(1000e6, 0.25e18)`
4. Lower oracle rate: `assetToPtUnderlyingOracle.setPrice(8.5e5)`
5. Attempt another wrap: `scenarioDepositAssetsAndWrapBeforeMaturity(1000e6, 0.25e18)` reverts on underflow in `maturityAssetAmount - totalWrappedAssets - _alreadyInterpolatedYield`
**How found:** Code reading of _interpolatingYield: noticed maturityAssetAmount is derived from a live oracle rate while totalWrappedAssets is a stored cumulative value, so a rate decrease can invert the subtraction; confirmed with a Foundry PoC manipulating the oracle price.
**Insight:** When a contract subtracts a stored cumulative total from a value recomputed via a live oracle, check monotonicity assumptions: any oracle decrease can underflow and permanently brick the entry path.