# Caching Uniswap position liquidity allows borrowing using undercollateralized Uni positions

Arcadia caches Uniswap V3 position liquidity at deposit-processing time; an ERC777 tokensToSend hook lets the depositor withdraw all liquidity before transfer, so an empty position still counts as collateral.

- Payout: Contest reward
- Severity: high
- Program: Arcadia
- Credited: 0xadrii
- Disclosed: 2023-12-17
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-12-arcadia-judging/issues/154
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation vuln:reentrancy

**Target:** AccountV1.deposit / UniswapV3AM asset module
**Root cause:** Deposit is two-phase: batchProcessDeposit caches position liquidity into assetToLiquidity before assets are transferred. During the ERC777 transfer the depositor still owns the NFT and can decreaseLiquidity, leaving cached liquidity stale.
**Steps:**
1. Deploy attacker contract implementing IERC777Sender.tokensToSend that calls nonfungiblePositionManager.decreaseLiquidity for the position.
2. Open margin account with LendingPool as creditor.
3. Call `proxyAccount.deposit([token777, nonfungiblePositionManager], [0, tokenId], [1, 1])` with ERC777 first.
4. batchProcessDeposit caches full liquidity into assetToLiquidity[tokenId].
5. ERC777 transfer triggers tokensToSend; decreaseLiquidity drains position to 0 while attacker still owns NFT.
6. NFT then transferred into account; getCollateralValue still uses cached liquidity > 0.
7. Borrow against phantom collateral.
**How found:** Code review of the two-step deposit flow: noticed liquidity is cached in batchProcessDeposit before asset transfer, and that the depositor still owns the NFT during the ERC777 transfer callback, enabling a decreaseLiquidity reentrancy.
**Exploitation:** Attacker deposits 1 wei of an ERC777 token alongside a Uniswap V3 NFT. The ERC777 hook fires before the NFT transfer, letting the attacker zero out the position's liquidity via decreaseLiquidity. Arcadia's cached liquidity keeps the collateral value high, enabling undercollateralized borrows; repeating across positions drains the pool.
**Escalation:** Scale across many Uniswap positions to drain lending pool liquidity.
**Insight:** When a protocol caches an asset's on-chain state during a pre-transfer phase, look for any callback (ERC777/ERC721/ERC1155 hooks) in the transfer phase that lets the still-owner mutate that state before it is locked in.