# withdrawNftWithInterest() possible take away other Lien's NFT

withdrawNftWithInterest() deletes a lien and transfers the NFT without checking for an active loan, letting a prior lender steal an NFT re-deposited by a new borrower.

- Payout: Contest reward
- Severity: high
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2023-08-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-particle-findings/issues/13
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-particle%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Lien NFT lending contract, withdrawNftWithInterest()
**Root cause:** withdrawNftWithInterest() only checks msg.sender == lien.lender and that the NFT is in the contract, but never verifies the lien has no active loan; multiple liens can exist for the same NFT/tokenId.
**Steps:**
1. Alice transfers NFT_A and supplies Lien[1].
2. Bob calls sellNftToMarket(); Jack buys NFT_A from the market.
3. Jack transfers NFT_A back and supplies Lien[2] (NFT_A now held by contract).
4. Alice calls `withdrawNftWithInterest(lien1, 1)`; contract deletes lien[1] and `safeTransferFrom(address(this), Alice, tokenId)` succeeds.
5. Jack's NFT_A is transferred to Alice; Jack loses NFT and Bob loses funds.
**How found:** Code reading of withdrawNftWithInterest: noticed the only guard is msg.sender == lien.lender and that the NFT is present, with no check that the lien's loan is inactive; observed protocol permits multiple liens per NFT.
**Exploitation:** Attacker (original lender) waits until a new borrower re-deposits the same NFT creating a fresh lien, then calls withdrawNftWithInterest on their stale lien to pull the NFT out of the contract, deleting only their own lien record.
**Insight:** When a withdraw function's only precondition is 'NFT is in the contract', check whether the same tokenId can be re-deposited under a different lien/loan record — stale lien records can be replayed to drain re-collateralized assets.