# Creditor can maliciously burn UniV3 position to permanently lock funds

Malicious lender burns their UniV3 LP NFT, making ownerOf() revert and permanently locking all loans in the borrowing position.

- Payout: Contest reward
- Severity: high
- Program: Real Wagmi
- Credited: 0x52
- Disclosed: 2023-10-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/78
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidityBorrowingManager / LiquidityManager lending contracts
**Root cause:** Repayment, liquidation and emergency withdrawal loops call underlyingPositionManager.ownerOf(loan.tokenId) for every loan; ownerOf reverts for burned tokenIds, so one burned NFT bricks all paths.
**Steps:**
1. Lender opens loan with a UniV3 LP NFT they control.
2. Lender burns the NFT via NonfungiblePositionManager, so ownerOf(tokenId) reverts.
3. Borrower attempts repay/liquidation: loop hits `ownerOf(loan.tokenId)` and reverts.
4. Other lenders attempt emergency withdrawal: same loop reverts, funds locked.
**How found:** Code reading: noticed ownerOf reverts for nonexistent tokens and that all repayment/emergency loops query ownerOf per loan, so a single burned token bricks the whole loop.
**Exploitation:** Malicious creditor burns their LP NFT after loans are opened; every repay, liquidation, and emergency withdrawal path iterates loans and calls ownerOf, which reverts on the burned tokenId, permanently locking all funds in the position.
**Insight:** When a contract iterates over user-controlled NFT tokenIds and calls ownerOf, consider that burnable tokens make ownerOf revert and can DoS the entire loop; cache the creditor at loan creation instead.