LPholders can be prevented from burning their position NFTs

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/periphery/NonfungiblePositionManager.sol#L246
https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/periphery/NonfungiblePositionManager.sol#L410

Vulnerability details

Proof of Concept

Liquidity providers can burn their position during NonfungiblePositionManager.sol:collect() if there's no liquidity and no tokens owed

 function collect(CollectParams calldata params)
    external
    payable
    override
    isAuthorizedForToken(params.tokenId)
    returns (uint256 amount0, uint256 amount1)
  {
    .......

    // if there's no liquidity and no tokens owed, burn the position
 
 @>   if (position.liquidity == 0) {
      delete _positions[params.tokenId];
 @>     _burn(params.tokenId);
    }

....
  }

But increaseLiquidity has no access control, and anyone can increase a position's liquidity by any amount, no matter how little.

    function increaseLiquidity(
        IncreaseLiquidityParams calldata params
    )
        external
        payable
        override
        checkDeadline(params.deadline)
        returns (uint128 liquidity, uint256 amount0, uint256 amount1)
    {
  @>      Position storage position = _positions[params.tokenId];

        PoolAddress.PoolKey memory poolKey = _poolIdToPoolKey[position.poolId];

        IRamsesV3Pool pool;
  @>      (liquidity, amount0, amount1, pool) = addLiquidity(
            AddLiquidityParams({
                token0: poolKey.token0,
                token1: poolKey.token1,
                tickSpacing: poolKey.tickSpacing,
                tickLower: position.tickLower,
                tickUpper: position.tickUpper,
                amount0Desired: params.amount0Desired,
                amount1Desired: params.amount1Desired,
                amount0Min: params.amount0Min,
                amount1Min: params.amount1Min,
                recipient: address(this),
                index: params.tokenId
            })
        );

// ...
 @>      position.liquidity += liquidity;

A malicious user in a griefing attack can continously increase liquduity by as low as 1 wei to continously dos attempt to burn a position

Recommended Mitigation Steps

Ensure only a position owner can increase his liquidity.

Assessed type

DoS

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid