# Incorrect assumption that PT rate is 1.0 post-expiry

PendlePTOracle hardcodes PT rate to 1.0 post-expiry, but PT redeems 1:1 for accounting asset (eETH) not underlying (weETH), inflating collateral and enabling over-borrowing.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: lemonmon
- Disclosed: 2024-06-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/69
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** PendlePTOracle.sol _calculateBaseToQuote / Notional Pendle PT oracle
**Root cause:** Post-expiry the oracle assumes 1 PT = 1 unit of underlying SY (weETH), but PT redeems 1:1 for the accounting asset (eETH), which trades below weETH; actual PT/SY rate was ~0.9598, not 1.0.
**Steps:**
1. Configure PT weETH 27JUN2024 with useSyOracleRate=true (PendlePTTests.yml line 59).
2. Read PendlePTOracle._calculateBaseToQuote: `int256 ptRate = expiry <= block.timestamp ? ptDecimals : _getPTRate();` hardcodes 1.0 post-expiry.
3. Query Pendle PT Oracle getPtToSyRate for expired market 0x9520...8472: returns 0.9598002817, not 1.0.
4. Compare weETH (3590 USD) vs eETH (3438 USD) on 1 July: 152 USD gap per PT.
5. Oracle returns inflated baseToQuote, overvaluing collateral.
**How found:** Reviewer noticed the post-expiry hardcode comment claiming PT is worth 1 unit of underlying SY, cross-checked Pendle docs stating PT redeems 1:1 for the accounting asset (not underlying), then empirically queried the live Pendle PT Oracle for the expired market and found 0.9598 instead of 1.0.
**Exploitation:** Attacker deposits PT weETH into the vault post-expiry; oracle values each PT at 1 weETH (~3590 USD) instead of ~1 eETH (~3438 USD), inflating collateral value; attacker borrows against the inflated collateral and walks away with the difference, draining protocol assets.
**Insight:** When an oracle short-circuits to a constant at a lifecycle boundary (expiry, maturity, epoch rollover), verify the constant against the live on-chain rate source for that exact state; PT/YT redemption is denominated in the accounting asset, not the underlying, so '1 PT = 1 underlying' assumptions overvalue reward-bearing collateral.