# Not transferring collateral when submitting bids allows malicious users to create honeypot-style attacks

Teller checks but doesn't escrow bid collateral, so a borrower frontruns lenderAcceptBid by draining a Uniswap V3 LP NFT to near-zero, leaving the lender with worthless collateral.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0xadrii
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/219
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** TellerV2 lending contract / collateral manager
**Root cause:** submitBid only verifies the borrower's collateral balance without transferring or escrowing the collateral; the NFT stays under borrower control until lenderAcceptBid pulls it, so its value can be altered between bid and acceptance.
**Steps:**
1. Borrower calls `submitBid` with a Uniswap V3 LP NFT worth ~10 ETH as collateral, requesting only 1 ETH loan.
2. Lender sees attractive bid and submits `lenderAcceptBid(_bidId)`.
3. Borrower frontruns the lender tx and calls Uniswap to decrease/remove liquidity from the LP NFT, dropping its value to ~0.
4. Lender's `lenderAcceptBid` executes: `collateralManager.deployAndDeposit(_bidId)` pulls the now-worthless NFT, and borrowed funds are sent to borrower.
**How found:** Code reading of the two-step submit/accept flow: noticed collateral is only balance-checked at submitBid and actually pulled at lenderAcceptBid, leaving a window where the borrower still owns and can mutate the collateral NFT.
**Exploitation:** Attacker lists a high-value mutable NFT (Uniswap V3 LP position) as collateral for a small loan, waits for a lender to accept, frontruns acceptance by removing liquidity so the NFT is near-worthless, then collects the loan with no real collateral cost.
**Insight:** For any lending protocol, check whether collateral is escrowed at bid time or only at acceptance; mutable-value NFTs (Uniswap V3 LP positions, ERC-4626-style positions) can be drained in the gap between listing and acceptance, so look for frontrunnable value-changing operations on collateral still held by the borrower.