# Escrowed NFT can be stolen by anyone if no active buyPrice or auction exists for it

NFTs sent directly to Foundation's market contract without buyPrice or auction could be stolen for a tiny offer via makeOffer/acceptOffer.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: hyh
- Disclosed: 2022-05-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-02-foundation-findings/issues/51
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-foundation%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FNDNFTMarket escrow transfer logic (NFTMarketOffer/Core)
**Root cause:** _transferFromEscrow falls through to NFTMarketCore's plain transfer when no buyPrice/auction/offer escrow structure exists, so any seller-authorized offer can move an unallocated NFT held by the contract.
**Steps:**
1. Attacker calls `makeOffer` with a tiny amount on an NFT held by FNDNFTMarket that has no buyPrice or auction initialized.
2. Attacker calls `acceptOffer`, reaching `_acceptOffer`.
3. Direct transfer fails since contract holds NFT, so `_transferFromEscrow` is invoked.
4. No NFTMarketOffer/BuyPrice/ReserveAuction structure matches, so each mixin passes through to NFTMarketCore's plain transfer.
5. NFT is transferred to attacker for gas plus the tiny offer price.
**How found:** Code-reading of the _transferFromEscrow override chain: noticed the mixin fall-through to NFTMarketCore's plain transfer when no escrow manager claims the NFT, implying unallocated NFTs are unprotected.
**Exploitation:** Attacker monitors FNDNFTMarket for NFTs lacking buyPrice/auction structures (e.g. mistakenly sent), makes a minimal offer, then accepts it to receive the NFT for near-zero cost.
**Insight:** When multiple mixins override a shared internal function and chain via super, check the terminal base implementation: if it performs the transfer unconditionally, any asset not claimed by a specific escrow manager becomes freely transferable.