# Fee Distribution Re-Entrancy

NFTXFeeDistributor.distribute lacks reentrancy protection and calls receiver fallbacks, letting a malicious fee receiver re-enter and drain allocations repeatedly.

- Payout: Audit contest
- Severity: medium
- Program: NFTX
- Disclosed: 2021-06-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-nftx-findings/issues/11
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-nftx%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:reentrancy

**Target:** NFTXFeeDistributor.distribute function
**Root cause:** distribute() has no access control and no reentrancy guard, and it invokes an external call (receiveRewards fallback) on each fee receiver before/while distributing, so a receiver can re-enter distribute with the same vault ID.
**Steps:**
1. Deploy a contract implementing receiveRewards that calls back into NFTXFeeDistributor.distribute with the same vault ID.
2. Get the malicious contract registered as a fee receiver (e.g. via an upgradeable receiver contract replaced with a malicious implementation).
3. Trigger distribute for the vault; the external call to the malicious receiver re-enters distribute.
4. Repeat the reentrant call to repeatedly claim the receiver's allocation, draining the full balance and leaving other recipients with zero.
**How found:** Code review of NFTXFeeDistributor.distribute: noticed missing access control and external calls to fee receivers, hypothesized a receiver could re-enter.
**Exploitation:** A malicious fee receiver re-enters distribute() on each callback, repeatedly taking its share until the distributor balance is drained; remaining recipients receive zero.
**Insight:** When auditing reward/fee distributors, check whether payout loops make external calls to recipient-controlled addresses without a reentrancy guard; upgradeable receiver contracts are a path to injecting a malicious callback.