# NFT flashloans can bypass sale constraints

Boot Finance public sale gated NFT-holder access via balanceOf check, bypassable by flashloaning an NFT to pass the check and returning it same transaction.

- Payout: Audit contest
- Severity: medium
- Program: Boot Finance
- Found by: pauliax
- Disclosed: 2022-01-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-bootfinance-findings/issues/276
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AM-09
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan

**Target:** Solidity public sale contract (burnEtherForMember) with NFT-gated access
**Root cause:** Access control relies on a point-in-time nft.balanceOf(msg.sender) > 0 check rather than ownership persistence, so a borrowed NFT satisfies it within a single transaction.
**Steps:**
1. Observe sale gate: `require(nft.balanceOf(msg.sender) > 0, "You need NFT to participate in the sale.")` for currentEra < firstPublicEra.
2. Flashloan an NFT (e.g. via NFTfi-style lender or a wrapper) so msg.sender holds balance > 0.
3. Call `burnEtherForMember` to participate in the sale while holding the borrowed NFT.
4. Repay/return the NFT in the same transaction; repeat with the same NFT for any address.
**How found:** Code review of the sale access check; recognized that balanceOf is a spot check satisfiable transiently via flashloan rather than requiring durable ownership.
**Exploitation:** Attacker flashloans a single NFT, calls the sale entrypoint to pass the balanceOf gate, then returns the NFT within one transaction, granting sale access to arbitrary addresses without owning the NFT.
**Escalation:** One NFT can be re-flashloaned repeatedly to grant sale access to unlimited participants, defeating the holder-exclusive pre-sale.
**Insight:** Any access gate keyed on current token balance (ERC20/ERC721/ERC1155) is flashloan-bypassable; look for balanceOf/holdings checks in allowlists, tiered sales, and gated mints and test whether a same-tx borrow satisfies them.