_deleteLienPosition can be called by anyone to delete any lien they wish
`_deleteLienPosition` is a public function that doesn't check the caller. This allows anyone to call it an remove whatever lien they wish from whatever collateral they wish\\n```\\nfunction _deleteLienPosition(uint256 collateralId, uint256 position) public {\\n  uint256[] storage stack = liens[collateralId];\\n  require(position < stack.length, "index out of bounds");\\n\\n  emit RemoveLien(\\n    stack[position],\\n    lienData[stack[position]].collateralId,\\n    lienData[stack[position]].position\\n  );\\n  for (uint256 i = position; i < stack.length - 1; i++) {\\n    stack[i] = stack[i + 1];\\n  }\\n  stack.pop();\\n}\\n```\\n\\n`_deleteLienPosition` is a `public` function and doesn't validate that it's being called by any permissioned account. The result is that anyone can call it to delete any lien that they want. It wouldn't remove the lien data but it would remove it from the array associated with `collateralId`, which would allow it to pass the `CollateralToken.sol#releaseCheck` and the underlying to be withdrawn by the user.
Change `_deleteLienPosition` to `internal` rather than `public`.
All liens can be deleted completely rugging lenders
```\\nfunction _deleteLienPosition(uint256 collateralId, uint256 position) public {\\n  uint256[] storage stack = liens[collateralId];\\n  require(position < stack.length, "index out of bounds");\\n\\n  emit RemoveLien(\\n    stack[position],\\n    lienData[stack[position]].collateralId,\\n    lienData[stack[position]].position\\n  );\\n  for (uint256 i = position; i < stack.length - 1; i++) {\\n    stack[i] = stack[i + 1];\\n  }\\n  stack.pop();\\n}\\n```\\n