# Borrower can be their own lender and steal funds from buyout due to reentrancy

Borrower self-lends then reenters repayAndCloseLoan via malicious ERC20 callback during buyout, keeping NFT, principal and interest while new lender gets worthless ticket.

- Payout: Audit contest
- Severity: high
- Program: Backed Protocol
- Credited: 0xDjango
- Disclosed: 2022-04-21
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-backed-findings/issues/85
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-backed%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reentrancy

**Target:** NFTLoanFacilitator.sol lend/buyout/repayAndCloseLoan
**Root cause:** Buyout transfers loan funds to current lender before transferring the lend ticket (violates checks-effects-interactions), so a malicious loan asset token can reenter repayAndCloseLoan during the transfer.
**Steps:**
1. Borrower calls `createLoan()` with a malicious/ERC777 loan asset token.
2. Borrower calls `lend()` on own loan, receiving lend ticket; funds transfer to self.
3. New lender calls buyout; contract does `safeTransferFrom(msg.sender, currentLoanOwner, accumulatedInterest + previousLoanAmount)` to borrower.
4. Malicious token's transfer callback reenters `repayAndCloseLoan(loanId)`; borrower repays and pulls collateral NFT out.
5. Original code then calls `loanFacilitatorTransfer` giving new lender a now-useless lend ticket.
**How found:** Code reading of buyout flow noticed funds sent to current lender before lend ticket transfer, i.e. external call before state update, enabling reentrancy; sponsor confirmed ERC777 loan asset makes it viable.
**Exploitation:** Attacker is both borrower and lender; uses a loan asset token with a transfer hook (ERC777-style) to reenter repayAndCloseLoan during the buyout payout, extracting the buyout funds plus collateral NFT while the victim lender receives a worthless lend ticket.
**Insight:** In NFT lending/buyout flows, check ordering of ERC20 payout vs. ticket/NFT ownership transfer; any loan-asset token with transfer hooks (ERC777) turns the payout into a reentrancy window into repay/close functions.