# Position NFT can be spammed with insignificant positions by anyone until rewards DoS

Anyone can memorialize dust positions onto another user's Position NFT, bloating positionIndexes until reward calculation and burning hit the block gas limit.

- Payout: Contest reward
- Severity: high
- Program: Ajna Protocol
- Credited: 0xTheC0der
- Disclosed: 2023-06-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/488
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** PositionManager / RewardsManager NFT position tracking
**Root cause:** memorializePositions is callable by anyone and accepts any value > 0, appending to the target tokenId's positionIndexes array without owner consent; getPositionIndexesFiltered iterates this unbounded array.
**Steps:**
1. Attacker calls `PositionManager.memorializePositions(params_)` with `params_.tokenId` set to victim's NFT and dust amounts (1 wei) at many indexes.
2. Each call appends entries to `positionIndexes[tokenId]` storage array.
3. Repeat until array is large enough that `getPositionIndexesFiltered(tokenId_)` exceeds block gas limit.
4. Victim's `RewardsManager.calculateRewards` / `_calculateAndClaimRewards` revert; `PositionManager.burn` also reverts.
**How found:** Code reading of memorializePositions access control and the unbounded positionIndexes array consumed by getPositionIndexesFiltered, which RewardsManager depends on; confirmed via Foundry test diff switching caller to a non-owner address with 1-wei amounts.
**Exploitation:** Griefer repeatedly memorializes 1-wei positions onto a victim's NFT, growing the positionIndexes array until any iteration over it exceeds the block gas limit, permanently blocking reward claims and NFT burning for the victim.
**Insight:** When a permissionless function appends to a per-NFT storage array that downstream reward/claim logic iterates, check whether the array is bounded and whether the caller must be the owner; dust-value writes are enough to grief.