# LendingPair.withdrawUniPosition should accrue debt first

LendingPair.withdrawUniPosition skips debt accrual before health check, letting undercollateralized accounts withdraw their Uniswap V3 collateral NFT.

- Payout: Audit contest
- Severity: medium
- Program: Wild Credit
- Found by: cmichel
- Disclosed: 2021-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-wildcredit-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-wildcredit%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LendingPair.withdrawUniPosition collateral withdrawal / health check
**Root cause:** withdrawUniPosition performs a health check but does not accrue interest on both tokens first, so the recorded totalDebtAmount understates the caller's actual debt.
**Steps:**
1. Identify a low-activity market where debt has not accrued for a long time.
2. Call `LendingPair.withdrawUniPosition` to withdraw the Uniswap V3 position NFT.
3. Health check uses stale recorded debt, so an account with de-facto negative health ratio passes and withdraws collateral.
**How found:** Code review of withdrawUniPosition: noticed the health check runs without first calling accrue on both tokens, unlike other flows.
**Exploitation:** Borrower in a stale-debt market withdraws their Uniswap V3 collateral NFT while their true accrued debt would make them insolvent, leaving bad debt in the protocol.
**Insight:** In lending protocols, any function that runs a solvency/health check must accrue interest first; audit every collateral-moving path for a missing accrue call, especially in low-activity markets where stale debt diverges most.