# Reentrancy at _requestLoan allows requesting a loan without supplying collateral

NFTPair._requestLoan updates state after collateral transferFrom, letting a malicious ERC721 hook reenter, request a loan, withdraw collateral, and leave lender exposed.

- Payout: Audit contest
- Severity: medium
- Program: Abracadabra Money
- Credited: kenzo
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-abranft-findings/issues/61
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reentrancy

**Target:** NFTPair / NFTPairWithOracle lending contract
**Root cause:** _requestLoan performs the external collateral.transferFrom call before updating loan state (status/details), violating checks-effects-interactions.
**Steps:**
1. Deploy malicious ERC721 whose afterTokenTransfer hook calls back to attacker.
2. Call `requestLoan(tokenId, ..., skim=false)`; contract calls `collateral.transferFrom()` moving NFT in.
3. In afterTokenTransfer hook, reenter `requestLoan(..., skim=true)`; status still LOAN_INITIAL and ownership check passes, so loan details/status get set.
4. Still in hook, call `removeCollateral(tokenId)`; succeeds since loan status is requested, NFT returned to attacker.
5. Hook returns; original requestLoan resumes and writes loan details, marking loan valid with no collateral held.
**How found:** Code reading of _requestLoan ordering: external transferFrom before state update, combined with knowledge that ERC721 _afterTokenTransfer hooks can reenter.
**Exploitation:** Attacker borrows against a loan with no collateral in contract; an unwitting lender funds the loan and attacker never repays, stealing lender funds. Requires collateral token with transfer hook (not safeTransfer).
**Insight:** Even without safeTransfer, ERC721 _afterTokenTransfer fires on plain transferFrom; check any lending/escrow contract that transfers collateral in before writing loan state for reentrancy via token hooks.