# DoS on hook when using ETH

YieldHarvestingHook casts native ETH currency address (0x0) to IVaultWrapper, so pendingYield() call reverts and blocks LP withdrawals once yield accrues.

- Payout: Contest reward
- Severity: high
- Program: VII Finance
- Credited: santipu
- Disclosed: 2026-03-07
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_vii_finance_jan2026.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.5
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Uniswap v4 hook (YieldHarvestingHook.sol)
**Root cause:** _currencyToVaultWrapper casts Currency.unwrap(currency) directly to IVaultWrapper; for native ETH the address is 0x0, so the external pendingYield() call hits a non-contract address and reverts. The try/catch does not catch this because the revert occurs on the call to a non-contract, not inside the callee.
**Steps:**
1. Deploy/use a Uniswap v4 pool where one currency is native ETH (address 0x0).
2. Accrue the first yield so _getPendingYield is invoked for the ETH currency.
3. _currencyToVaultWrapper returns IVaultWrapper(0x0); calling pendingYield() reverts with 'call to non-contract address 0x0...'.
4. Hook reverts, blocking LP withdrawals.
**How found:** Code reading of _getPendingYield/_currencyToVaultWrapper: noticed the try/catch assumes failure only for non-vault-wrapper contracts, but native ETH maps to address 0x0, which reverts at the call site rather than inside the callee.
**Exploitation:** Not weaponized; DoS triggers naturally once yield accrues in an ETH-paired pool, preventing LPs from withdrawing.
**Insight:** In Solidity, try/catch only catches reverts from the called contract's code; a call to a non-contract address (like native ETH's 0x0 sentinel) reverts before the try body and escapes the catch. Audit any Currency/address cast that assumes a deployed contract exists.