# Approval for NFT transfers is not removed after transfer

Visor.transferERC721 leaves stale NFT approval, letting a prior delegatee pull the NFT out of the vault a second time after it is re-deposited.

- Payout: Audit contest
- Severity: high
- Program: Visor
- Found by: cmichel
- Disclosed: 2021-08-30
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-visorfinance-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-visorfinance%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Visor vault contract transferERC721 function
**Root cause:** transferERC721 moves the NFT out but never clears the delegatee approval granted to the contract's operator, so the approval persists across transfers and re-deposits.
**Steps:**
1. Vault holds an NFT and has approved a delegatee (operator) for transfers.
2. Owner calls `Visor.transferERC721` to move the NFT out; approval is not reset.
3. NFT is sold/deposited back into the same vault.
4. The original delegatee reuses the still-valid approval to transfer the NFT out again, stealing it.
**How found:** Code review of transferERC721 noticing the approval was never cleared after the transfer, then reasoning about the re-deposit scenario.
**Exploitation:** A previously approved delegatee waits until the same NFT is re-deposited into the vault, then calls transferFrom using the stale approval to move it to themselves.
**Insight:** When a contract acts as an NFT operator, check whether approvals are revoked on every path that moves the token out; a re-deposit reuses the same stale approval.