# Users can be locked out of providing Uniswap V3 NFTs as collateral

Attacker cheaply mints zero-liquidity Uniswap V3 NFTs and supplies them to a victim, hitting the 30-NFT balance limit and blocking further collateral deposits before liquidation.

- Payout: Contest reward
- Severity: medium
- Program: ParaSpace
- Credited: Jeiwan
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/334
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:dos

**Target:** MintableERC721Logic balance limit on Uniswap V3 NTokens
**Root cause:** The per-user balanceLimit (30) added to prevent gas-griefing via calculateUserAccountData is enforced on transfers/supplies to a recipient, so anyone can push a victim to the cap. Zero-liquidity Uniswap V3 NFTs are accepted, making the attack nearly free.
**Steps:**
1. Attacker mints a Uniswap V3 position with DAI/WETH via nftPositionManager.mint
2. Calls nft.decreaseLiquidity with full liquidity then nft.collect to recover all tokens, leaving a 0-liquidity NFT
3. Repeats using the same recovered tokens to mint more 0-liquidity NFTs
4. Calls pool.supplyERC721(nftPositionManager, tokenData[], victim, 0) supplying the NFTs on behalf of the victim
5. Victim's nUniswapV3 balance reaches balanceLimit (30); victim's own supplyERC721 reverts with error 120 (NTOKEN_BALANCE_EXCEEDED)
**How found:** Reasoned from the existing anti-griefing balanceLimit mitigation: since the limit is checked on the recipient balance during supply/transfer, an attacker can inflate a victim's balance. Noted Uniswap V3 NFTs can hold 0 liquidity, making the spam cheap.
**Exploitation:** Front-run a borrower's collateral top-up: bot detects pending supplyERC721, spams 0-liquidity NFTs to the borrower to fill the 30-NFT cap, causing the borrower's tx to revert; then liquidate the now-undercollateralized debt. Cost is only gas plus Uniswap rounding dust.
**Escalation:** Chained with liquidation bots to convert a DoS on collateral deposit into forced liquidation of the victim's debt.
**Insight:** When a protocol adds a per-user cap to stop gas-griefing, check whether the cap is enforced on the recipient rather than the sender — an attacker can fill a victim's quota with near-worthless assets (here 0-liquidity LP NFTs) to block legitimate deposits and trigger liquidation.