# Supply part of the accrued debt can be stolen

uniClaimDeposit mints supply shares without accruing debt; attacker deposits uncollected Uniswap V3 liquidity, mints huge shares, then accrues and withdraws to steal suppliers' interest.

- Payout: Audit contest
- Severity: medium
- Program: Wild Credit
- Found by: cmichel
- Disclosed: 2021-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-wildcredit-findings/issues/50
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-wildcredit%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LendingPair.uniClaimDeposit / depositUniPosition (Uniswap V3 NFT collateral)
**Root cause:** uniClaimDeposit mints supply shares without calling accrue first, so shares are priced before debt accrual; and decreaseLiquidity parks liquidity in tokensOwed0/1 which is counted as deposit without being collected.
**Steps:**
1. Create a Uniswap V3 position and flashloan both tokens to add large liquidity.
2. Call `positionManager.decreaseLiquidity` so liquidity is removed but parked in `tokensOwed0/1` (not collected).
3. Deposit the NFT via `depositUniPosition` to the WildCredit lending pair.
4. Call `uniClaimDeposit` to mint a huge amount of supply shares based on the parked liquidity.
5. Call `accrue(token0)` and `accrue(token1)` to increase `totalSupplyAmount` via lpRate.
6. Call `withdraw` to redeem shares at the inflated share price, capturing most of the newly accrued debt.
**How found:** Code review of uniClaimDeposit noticed no accrue call before minting shares; then traced Uniswap V3 decreaseLiquidity semantics to see liquidity is parked in tokensOwed0/1 and counted as deposit without collection.
**Exploitation:** Atomic tx: flashloan liquidity, park it in a Uniswap V3 position via decreaseLiquidity, deposit NFT, mint oversized shares via uniClaimDeposit, trigger accrue on both tokens, then withdraw to capture the accrued lpRate; repeat each accrual.
**Escalation:** Combining the missing accrue with the uncollected parked liquidity lets the attacker capture nearly the entire lpRate per accrual rather than just fees.
**Insight:** When a contract mints shares from a token balance, check whether pending accruals/interest are settled before the share price is computed; also check whether 'removed but uncollected' Uniswap V3 liquidity is counted as real deposit.