# Premium owed can be calculated as a very big number due to reentrancy on uninitialized pools

Reentrancy via ERC1155 mint callback on uninitialized SFPM pool lets attacker burn position, underflowing removedLiquidity and inflating premium owed.

- Payout: Contest reward
- Severity: medium
- Program: Panoptic
- Credited: tapir
- Disclosed: 2024-06-24
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-panoptic-findings/issues/355
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-panoptic%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:precision-loss vuln:reentrancy

**Target:** SemiFungiblePositionManager (SFPM) ERC1155 position minting
**Root cause:** SFPM.initializeAMMPool sets the reentrancy lock to false, and _mint is called before state updates, so an attacker's onERC1155Received can reenter burnTokenizedPosition on the same uninitialized pool, causing an unchecked underflow of removedLiquidity.
**Steps:**
1. Attacker contract implements onERC1155Received to call SFPM.initializeAMMPool(USDC, WETH, FEE_TIER) then SFPM.burnTokenizedPosition(tokenId, tokenId.positionSize(), low, high).
2. Attacker calls SFPM.mintTokenizedPosition with a short-type tokenId for the uninitialized USDC-ETH 0.05% pool; mint does not revert because pool is uninitialized.
3. During _mint, SFPM invokes attacker's onERC1155Received, which initializes the pool (unlocking reentrancy) and burns the position.
4. Burn flips long to short (isLong=0) and enters unchecked scope, underflowing removedLiquidity to a huge number; netLiquidity is increased with 1 ETH liquidity.
5. Control returns to original mintTokenizedPosition, which proceeds; _updateStoredPremia uses the huge removedLiquidity to compute an immensely large premiumOwed.
**How found:** Researcher observed that initializeAMMPool explicitly sets locked=false and that _mint is called before state updates, enabling reentrancy via ERC1155 callback on an uninitialized pool; they hypothesized burning during mint would underflow removedLiquidity.
**Exploitation:** Attacker deploys a contract with a malicious onERC1155Received callback. They call mintTokenizedPosition on an uninitialized pool; the callback initializes the pool and burns the position, underflowing removedLiquidity. The original mint then completes, and premium calculation uses the corrupted removedLiquidity, producing an enormous premiumOwed value that can disrupt premium accounting for that range and potentially other positions relying on it.
**Escalation:** Corrupted premium state for one range position may affect other positions or external protocols relying on SFPM premium accumulators, potentially leading to loss of funds.
**Insight:** When a pool initialization function resets a reentrancy lock, check whether an ERC1155/ERC721 mint callback can reenter before the position state is written; uninitialized pools bypass normal deposit checks, allowing burn-before-mint underflows.