# LP position provided as collateral can be made unwrappable and loans with such collateral have no incentives to be liquidated

Uniswap V3 positions with zero liquidity but positive tokensOwed can be wrapped as collateral yet never unwrapped, leaving liquidators with stuck collateral and removing liquidation incentive.

- Payout: Contest reward
- Severity: high
- Program: VII Finance
- Credited: vinicaboy
- Disclosed: 2026-03-07
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_vii_finance_jan2026.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:liquidation

**Target:** UniswapV3Wrapper / ERC721WrapperBase collateral vault
**Root cause:** balanceOf counts tokensOwed so a position with liquidity=0 still has value and can be enabled as collateral, but _unwrap passes liquidity=0 to NonfungiblePositionManager.decreaseLiquidity which requires params.liquidity > 0 and reverts.
**Steps:**
1. Mint a Uniswap V3 position, then call `decreaseLiquidity` with full liquidity but do not collect, leaving liquidity=0 and tokensOwed>0.
2. Call `wrapper.enableTokenIdAsCollateral(tokenId)` and `nonFungiblePositionManager.approve(wrapper, tokenId)`, then `wrapper.wrap(tokenId, borrower)`.
3. Observe `wrapper.balanceOf(borrower)` is positive (e.g. 1986875522437620845999951730000).
4. Borrow up to max LTV against it.
5. Attempt `wrapper.unwrap(borrower, tokenId, address(0), wrapper.FULL_AMOUNT(), "")` — reverts because `_decreaseLiquidity` calls `decreaseLiquidity` with liquidity=0.
6. Split ERC6909 shares across accounts so no single holder can unwrap the whole position either.
**How found:** Code reading of UniswapV3Wrapper._unwrap and _decreaseLiquidity against NonfungiblePositionManager's `require(params.liquidity > 0)` check, combined with noticing balanceOf accounts for tokensOwed after liquidity removal.
**Exploitation:** Attacker wraps a zero-liquidity position with positive tokensOwed, borrows max LTV, and defaults; liquidators who seize the collateral cannot unwrap it, so liquidation becomes disincentivized and bad debt accrues.
**Escalation:** Splitting ERC6909 tokens across multiple accounts prevents any single holder from unwrapping the full position, compounding the stuck-collateral effect.
**Insight:** When a wrapper values a position by tokensOwed plus liquidity, check every downstream path (unwrap, liquidate) against the underlying protocol's zero-value guards — a value-bearing state the wrapper accepts may be un-exitable by the underlying.