# Underflow could happened when calculating Uniswap V3 position's fee growth and can cause operations to revert

Particle's getFeeGrowthInside uses Solidity 0.8 checked math, so Uniswap V3 fee-growth underflow reverts liquidation and other core operations.

- Payout: Contest reward
- Severity: high
- Program: Particle Protocol
- Credited: said
- Disclosed: 2024-01-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AH-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** ParticlePositionManager / Base.getFeeGrowthInside library
**Root cause:** Uniswap V3 fee-growth accounting implicitly relies on uint256 underflow/overflow; Particle reimplemented getFeeGrowthInside in Solidity 0.8.23 where checked arithmetic reverts instead of wrapping.
**Steps:**
1. Set FEE=500 in test/Base.t.sol to use a low-fee pool.
2. Add testLiquidationRevert to test/OpenPosition.t.sol: open long position, reclaim liquidity, warp 7 days, compute swap data.
3. Call particlePositionManager.liquidatePosition with ClosePositionParams and expect revert InsufficientRepay.
4. Run forge test --fork-url $MAINNET_RPC_URL --fork-block-number 18750931 --match-test testRevertUnderflow -vvvv.
5. Observe liquidation reverts due to underflow in getFeeGrowthInside.
**How found:** Compared Particle's getFeeGrowthInside to Uniswap v3-periphery PositionValue and recalled Uniswap v3-core issue #573 noting fee-growth math relies on underflow/overflow; noticed Particle compiles with 0.8.23 checked math, then wrote a fork PoC showing liquidation revert.
**Exploitation:** Not an attacker-extracted exploit; the flaw causes legitimate liquidation calls to revert, potentially blocking liquidations and leaving bad debt. Triggered naturally on low-fee pools where feeGrowthGlobal minus outside values underflows.
**Insight:** When porting Uniswap V3 fee-growth/tick math into 0.8.x, wrap the subtractions in unchecked — the original relies on modular wraparound, and checked math turns benign underflow into DoS of liquidation paths, especially on low-fee pools.