# Randomization of NFTs returned in redeem/swap operations can be brute-forced

NFTX redeem/swap randomization based on nonce+blockhash is brute-forceable by contracts that revert unless the desired NFT ID is returned.

- Payout: Audit contest
- Severity: medium
- Program: NFTX
- Disclosed: 2021-06-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-nftx-findings/issues/78
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-nftx%3AM-01
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** NFT vault redeem/swap randomization logic
**Root cause:** Random NFT selection uses on-chain nonce + blockhash, which a contract caller can observe and revert on, retrying until the desired NFT ID is drawn.
**Steps:**
1. Call redeem/swap from an attacker contract that receives the returned NFT IDs.
2. Check whether returned IDs match the desired NFT.
3. If not, revert the transaction so no state change persists.
4. Repeat until the randomization returns the target NFT ID.
**How found:** Reasoned that on-chain randomness (nonce + blockhash) is observable to the caller and that a contract can revert-and-retry, defeating the randomization goal; cited a similar Meebit exploit.
**Exploitation:** Attacker contract repeatedly invokes redeem/swap, inspects returned NFT IDs, and reverts unless the specific high-value NFT is returned, effectively selecting the NFT deterministically at gas cost.
**Insight:** Any on-chain randomness a caller can observe before committing state is grindable via revert-and-retry from a contract; restrict to EOA or use commit-reveal.