# OZ ERC1155Supply vulnerability

Overlay's ERC1155Supply-based collateral contract used OZ 4.3.2, whose totalSupply is stale during _beforeTokenTransfer, letting an attacker build then unwind in one tx to misprice notional/debt/cost/Oi.

- Payout: Audit contest
- Severity: high
- Program: Overlay Protocol
- Found by: pauliax
- Disclosed: 2022-01-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-overlay-findings/issues/127
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** OverlayV1OVLCollateral ERC1155 collateral contract (Solidity)
**Root cause:** OZ 4.3.2 ERC1155Supply updates totalSupply after _beforeTokenTransfer hooks, so during a build callback totalSupply is stale; unwind reads totalSupply to compute _userNotional, _userDebt, _userCost, _userOi.
**Steps:**
1. Deploy against OverlayV1OVLCollateral inheriting ERC1155Supply from OZ 4.3.2
2. Call `build` to mint collateral shares
3. In the same transaction, on the callback invoke `unwind` before totalSupply is updated
4. Observe unwind computes _userNotional/_userDebt/_userCost/_userOi from stale totalSupply
**How found:** Code review of dependency version (OZ 4.3.2) and inheritance of ERC1155Supply, cross-referenced with the published OZ advisory GHSA-wmpv-c2jp-j2xg, then traced unwind's reliance on totalSupply.
**Exploitation:** Attacker calls build then reenters unwind within the same transaction while totalSupply is not yet incremented, causing unwind's share math to use an incorrect supply and misprice the user's notional, debt, cost and open interest.
**Insight:** When a contract inherits OZ ERC1155Supply, check the version: pre-4.3.3 updates totalSupply after transfer hooks, so any function reading totalSupply inside a mint/burn callback (reentrancy path) sees stale supply — grep for totalSupply reads in hook-reachable code.