# Attacker can create token account for nft position to cause deposit DoS

Attacker pre-creates the lockbox's ATA for a victim's Whirlpool position NFT, so Anchor's init constraint fails and deposit is permanently DoS'd.

- Payout: Contest reward
- Severity: medium
- Program: Olas Lockbox
- Credited: Mario Poneder
- Disclosed: 2024-03-11
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_olas_lockbox_jan2024.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Aolas_lockbox_jan2024%3A3.2.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solana technique:source-review vuln:business-logic vuln:dos

**Target:** Solana Anchor program liquidity_lockbox::deposit
**Root cause:** The pda_position_account ATA uses Anchor's `init` constraint, which fails if the account already exists; the ATA address is derivable from the public lockbox PDA and position mint.
**Steps:**
1. Derive the lockbox PDA and the victim's position_mint (public once a Whirlpool position is opened).
2. Compute the ATA for (lockbox PDA, position_mint) via getOrCreateAssociatedTokenAccount with allowOwnerOffCurve=true.
3. Attacker pays rent and creates that ATA before the victim deposits.
4. Victim calls `liquidity_lockbox::deposit(...)`; Anchor `init` on pda_position_account fails with 'Provided owner is not allowed', reverting the deposit.
**How found:** Code review of the DepositPositionForLiquidity account context: noticed `init` constraint on an ATA whose address is fully predictable from public inputs, then wrote a test creating the ATA from a separate attacker wallet to confirm deposit reverts.
**Exploitation:** Anyone can front-run or preemptively create the ATA for any targeted position mint at negligible rent cost, permanently blocking that NFT position from being deposited into the lockbox.
**Insight:** On Solana, any `init`-constrained PDA/ATA whose address derives from public inputs is griefable: an attacker can pre-fund it to force 'account already in use'. Audit every `init` on deterministic addresses for DoS, and prefer `init_if_needed` or seed-derived PDAs.