# Malicious lender can manipulate the fee to force borrower pay high premium

Lender can inflate Uniswap V3 fee growth in the borrowed position's tick range to force borrower to pay a higher premium on close.

- Payout: Contest reward
- Severity: medium
- Program: Particle Protocol
- Credited: ladboy233
- Disclosed: 2024-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-particle-findings/issues/18
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-particle%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** ParticlePositionManager leverage/premium calculation using Uniswap V3 position fee growth
**Root cause:** Premium owed is computed from spot feeGrowthInside values of the Uniswap V3 position at close time, without capping, so a lender who dominates the tick range can manipulate fee growth via swaps.
**Steps:**
1. Borrower opens a leveraged position via ParticlePositionManager, which snapshots feeGrowthInside0LastX128 and feeGrowthInside1LastX128 from UNI_POSITION_MANAGER.positions(tokenId).
2. Lender adds large liquidity to the same tick range of the Uniswap V3 position (or dominates the range).
3. Lender swaps back and forth within the tick range to inflate feeGrowthInside for that position.
4. Borrower closes the position; ParticlePositionManager reads current feeGrowthInside and computes token0Owed/token1Owed via Base.getOwedFee using the stored snapshot.
5. The inflated fee growth increases the premium owed, which is deducted from borrower's collateral/position value; lender collects most of the swap fees plus the higher premium.
**How found:** Code review of premium calculation: noticed feeGrowthInside is read from Uniswap position manager at close time and used directly to compute owed fees, without a cap, enabling manipulation by a lender who controls liquidity in the tick range.
**Exploitation:** Lender provides majority liquidity in the position's tick range, then performs swaps to generate fee growth. On borrower close, the premium is calculated from the inflated fee growth, forcing the borrower to pay more. Lender recovers most swap fees as the dominant LP, netting the premium minus gas and trading fees.
**Insight:** When a protocol uses Uniswap V3 feeGrowthInside as a proxy for accrued fees or premium, check if it is snapshotted and capped; a lender who dominates the tick range can inflate it via swaps to extract value from borrowers.