# Minting an NFT with a position on the same bucket as a previously minted NFT changes its deposit time

PositionManager maps multiple users to one pool lender, so minting an NFT in an occupied bucket overwrites the earlier user's depositTime, triggering early-withdrawal fees.

- Payout: Contest reward
- Severity: medium
- Program: Ajna
- Credited: MalfurionWhitehat
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/19
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PositionManager / LenderActions.transferLPs in Ajna pool contracts
**Root cause:** PositionManager centralizes all memorialized positions under one lender address per pool, so transferLPs sets depositTime to max(existing, new) when a second user mints into the same bucket, overwriting the first user's timestamp.
**Steps:**
1. User1 memorializes a position on bucket B via PositionManager (depositTime = t1).
2. Wait past the early-withdrawal window so User1 should owe no fee.
3. User2 memorializes a position on the same bucket B; `newLender.depositTime = Maths.max(lenderDepositTime, newLender.depositTime)` sets both to t2 > t1.
4. User1 withdraws and is charged the early-withdrawal penalty based on the newer depositTime.
**How found:** Code review of PositionManager's shared-lender design; noticed transferLPs uses Maths.max on depositTime, implying a single lender slot is shared across users, then reasoned about the fee/bankruptcy consequences.
**Exploitation:** Not an attack per se: any user minting an NFT into an already-occupied bucket silently resets co-located users' depositTime, causing them to pay early-withdrawal fees and skewing bankruptcy LP accounting.
**Insight:** When a wrapper contract aggregates many users' positions under one on-chain lender identity, any per-lender scalar (timestamps, reward debt, fee tiers) becomes shared state; check every max/min/assignment on those fields for cross-user contamination.