# Lost NFT if farmingContract is incorrectly set Low/Info · Three Sigma · DeFi infrastructure · 15th March 2024 Finding 3S-Clip-L07 of the Clip Finance Strategy Upgrade security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-strategy-upgrade - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-03-15-clip-finance-ii.pdf --- ### Description In [PHyperLPoolSwapInside::_depositNftToFarm()](https://github.com/ClipFinance/StrategyRouter-private/blob/v3-vault-swap-inside/contracts/liquidityManagment/PHyperLPoolSwapInside.sol#L454-L456), the NFT transfer will succeed if the farmingContract is incorrectly set. This is a possibility as the contracts are intended to be deployed in more than 1 chain, with [different](https://docs.pancakeswap.finance/developers/smart-contracts/pancakeswap-exchange/v3-contracts) addresses. ### Recomendation It should be enough checking if the address has code in the constructor if (farmingContract.code.length != 0) revert(). ### Status Addressed in [#0c8de23](https://github.com/ClipFinance/StrategyRouter-private/commit/0c8de23862d9fed65f3c1a3fc4eac9a0356ef76e#diff-2631c075c1b4a188d41759c50a858a3e1b36a6f808a6360b8957b7fce405a7eeR85). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [_addLiquidity() slippage is incorrectly set](https://0xsimao.com/findings/singularity-add-liquidity-slippage-incorrectly): Singularity - [SpiritVestingFactory::setTreasury() could be 2 factor, as well as the AccessControl OZ contract used in the codebase](https://0xsimao.com/findings/spirit-protocol-vesting-well-access-control): Spirit Protocol