# Users' newly created positions can be prematurely closed and removed from the vault directly after they are created

Anyone can call repay(tokenId, 0) on a freshly created zero-debt position, triggering full-repay cleanup that ejects the NFT from the vault and griefs the owner's borrow.

- Payout: Contest reward
- Severity: medium
- Program: Revert Lend
- Credited: JCN
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/232
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AM-15
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** V3Vault repay/onERC721Received loan lifecycle
**Root cause:** _repay does not reject amount==0, and the full-repay check currentShares==shares (0==0) fires for a zero-debt loan, invoking _cleanupLoan which removes the NFT from the vault.
**Steps:**
1. User creates position via create() or safeTransferFrom, triggering onERC721Received which sets loans[tokenId]=Loan(0) and _addTokenToOwner.
2. Attacker calls `vault.repay(TEST_NFT, 0, false)` on the zero-debt position.
3. In _repay, currentShares=0, shares=0, check `shares > currentShares` passes, and `currentShares == shares` is true.
4. _cleanupLoan runs: _removeTokenFromOwner, delete loans[tokenId], safeTransferFrom NFT back to owner.
5. User's subsequent `vault.borrow(TEST_NFT, collateralValue)` reverts with Unauthorized since position no longer exists.
**How found:** Code reading of onERC721Received and _repay: noticed loans are instantiated with zero debt and that _repay lacks a non-zero amount check, so the full-repay branch (currentShares == shares) triggers on 0==0 and calls _cleanupLoan.
**Exploitation:** Attacker front-runs or races the victim's borrow by calling repay with amount 0 on the victim's freshly created tokenId, forcing the vault to return the NFT and delete the loan record; victim's borrow then reverts, wasting gas and requiring re-creation.
**Insight:** In lending vaults, audit the zero/empty-state path of repay and liquidation: equality checks like currentShares == shares are true for brand-new zero-debt loans, so any permissionless repay(0) can trigger cleanup side effects (NFT ejection, storage deletion) as griefing.