# Position can be opened even when the particle position manger does not hold the Uniswap V3 Position NFT

ParticlePositionManager opens positions using a Uniswap V3 NFT it only has operator approval for, not ownership, letting anyone borrow against and drain a victim's LP liquidity.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: ladboy233
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/22
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ParticlePositionManager / Uniswap V3 NonfungiblePositionManager
**Root cause:** openPosition does not verify the ParticlePositionManager actually owns the Uniswap V3 position NFT; Uniswap's isAuthorizedForToken only requires operator approval, so an approved-but-not-owned NFT can be used to decrease liquidity and collect tokens.
**Steps:**
1. Victim approves ParticlePositionManager as operator on their Uniswap V3 NFT (a common approval, not intent to lend).
2. Attacker calls openPosition referencing the victim's tokenId; contract passes Uniswap's isAuthorizedForToken via operator approval despite not owning the NFT.
3. Contract calls decreaseLiquidity and collect on the victim's position, extracting tokens as the borrowed principal.
4. Attacker maintains sufficient premium to avoid liquidation for LOAN_TERM, keeping the leveraged position while victim's liquidity is reduced.
**How found:** Code reading: noticed openPosition lacks an ownership check on the NFT, and that Uniswap's isAuthorizedForToken modifier only requires approval/ownership, so operator approval suffices to decrease liquidity and collect.
**Exploitation:** Attacker leverages mere operator approval to open a position against a victim's Uniswap V3 NFT, decreasing its liquidity and collecting the underlying tokens as principal, then holds the position with adequate premium to avoid liquidation for the loan term.
**Insight:** When integrating with Uniswap V3 positions, distinguish operator approval from ownership: approval alone lets a contract decrease liquidity and collect, so any borrow/open flow must assert actual NFT ownership (ownerOf == address(this)), not rely on Uniswap's isAuthorizedForToken.