# V3Utils.execute() does not have caller validation, leading to stolen NFT positions from users

V3Utils.execute() lacked caller validation, letting anyone back-run a user's NFT approval to withdraw and swap all Uniswap V3 position liquidity to themselves.

- Payout: Contest reward
- Severity: high
- Program: Revert Lend
- Credited: 0xjuan
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/141
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** V3Utils.execute() transformer contract handling Uniswap V3 position NFTs
**Root cause:** execute() never verified that msg.sender owned the tokenId being operated on, so any caller could supply arbitrary Instructions against a position merely approved to the contract.
**Steps:**
1. Victim calls `NPM.approve(V3Utils, tokenId)` in TX1 (must be direct EOA call, cannot be bundled).
2. Attacker observes the approval and calls `V3Utils.execute(tokenId, bad_inst)` in TX2.
3. bad_inst sets `WhatToDo = WITHDRAW_AND_COLLECT_AND_SWAP`, `recipient = attacker`, `liquidity = liquidityBefore` (full position liquidity).
4. Contract withdraws, collects and swaps the position, sending all proceeds to attacker.
**How found:** Recognized that the two-transaction approve-then-execute flow leaves a window, and that execute() trusted the approval alone without checking ownerOf(tokenId) against msg.sender.
**Exploitation:** Attacker back-runs the victim's approval transaction; with no ownership check, execute() acts on the approved NFT, withdrawing 100% liquidity and routing collected DAI/USDC to the attacker's address at zero cost.
**Insight:** When a protocol requires a separate approve transaction before an operator call, check whether the operator validates NFT/token ownership at execution time — the approval window is a back-run opportunity for any approved-but-unowned asset.