# openPosition() Lack of minimum token0PremiumPortion/token1PremiumPortion limit

openPosition() allows zero premium portions, letting anyone borrow liquidity fee-free from out-of-price positions, denying LP fees and liquidator profit.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: bin2chen
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/27
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** ParticlePositionManager.openPosition()
**Root cause:** openPosition() does not enforce a minimum for token0PremiumPortion/token1PremiumPortion, allowing both to be zero. When a position is out-of-price, a borrower can open a new position with zero margin and zero swap, resulting in zero fees.
**Steps:**
1. Ensure a tokenId is out_of_price (e.g., UpperOutOfRange).
2. Call `openPosition` with `marginFrom=0`, `marginTo=0`, `amountSwap=0`, `liquidity>0`, `tokenFromPremiumPortionMin=0`, `tokenToPremiumPortionMin=0`, `zeroForOne=false`.
3. Observe that `token0Premium` and `token1Premium` are 0, so no fees are paid.
**How found:** The auditor noticed that openPosition() permits both premium portions to be zero and reasoned that for out-of-price positions, this allows borrowing with zero fees, then wrote a test to confirm.
**Exploitation:** An attacker calls openPosition on an out-of-price tokenId with zero margin and zero premium portions, borrowing liquidity without paying any fees. This occupies liquidity for free and prevents liquidators from profiting (since premiums are zero), while LPs earn no fees.
**Insight:** When a function accepts minimum premium parameters, check if zero values bypass fee logic, especially for out-of-price positions where normal fee accrual may not apply.