# Malicious seller forced break lockCapital()

Burned Goldfinch NFT makes ownerOf revert inside calculateRemainingPrincipal, bricking lockCapital so protections never lock and buyers lose compensation.

- Payout: Contest reward
- Severity: high
- Program: Carapace
- Credited: bin2chen
- Disclosed: 2023-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-carapace-judging/issues/31
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-carapace%3AH-11
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ProtectionPool.lockCapital / GoldfinchAdapter.calculateRemainingPrincipal
**Root cause:** calculateRemainingPrincipal calls _poolTokens.ownerOf(nftLpTokenId) without handling revert; Goldfinch PoolTokens.burn() destroys fully-redeemed NFTs, so ownerOf reverts on nonexistent token and the whole lockCapital loop reverts.
**Steps:**
1. Buy a protection on a lendingPool referencing a Goldfinch NFT LP token.
2. Fully redeem principal so principalRedeemed == principalAmount, then call PoolTokens.burn(nftLpTokenId).
3. LendingPool transitions Active->Late, DefaultStateManager calls ProtectionPool.lockCapital().
4. lockCapital loops active protections and calls calculateRemainingPrincipal, which calls ownerOf(burnedId) and reverts 'ERC721: owner query for nonexistent token'.
5. lockCapital reverts, status never moves to Late, capital never locks.
**How found:** Code-read the lockCapital loop into calculateRemainingPrincipal, noticed ownerOf() call, then checked Goldfinch PoolTokens for a burn path and ERC721 ownerOf revert semantics on nonexistent tokens.
**Exploitation:** Malicious seller buys protection, burns the NFT, then triggers/awaits Late state; lockCapital reverts for all protections in the pool, seller keeps PremiumAmount and buyers get no compensation.
**Escalation:** Single burned NFT DoSes lockCapital for every active protection on that lendingPool, not just the attacker's.
**Insight:** When integrating external NFT/ERC721 ownership checks in a loop, verify whether the token can be burned or transferred away; ownerOf reverts on nonexistent tokens and one revert bricks the whole batch.