# Some real-world NFT tokens may support both ERC721 and ERC1155 standards, which may break InfinityExchange::_transferNFTs

Infinity exchange's _transferNFTs prefers ERC721 interface; dual-standard tokens like Sandbox ASSETs transfer only one item while buyer pays for many.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: PwnedNoMore
- Disclosed: 2022-08-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/43
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** InfinityExchange::_transferNFTs NFT transfer logic
**Root cause:** _transferNFTs checks ERC721 interface (0x80ac58cd) before ERC1155 (0xd9b67a26); tokens supporting both route to _transferERC721s, which ignores the order's numTokens and transfers one item per safeTransferFrom call.
**Steps:**
1. Identify a collection supporting both interfaces, e.g. Sandbox ASSETs 0xa342f5d851e866e18ff98f351f2c6637f4478db5.
2. Confirm supportsInterface(0x80ac58cd)==true and supportsInterface(0xd9b67a26)==true.
3. Place an order buying multiple tokens of the same tokenId.
4. _transferNFTs routes to _transferERC721s; each safeTransferFrom is treated as a single-item ERC1155 transfer, so only one item moves.
5. Buyer pays full price but receives fewer tokens than ordered.
**How found:** Researcher noticed real-world ERC1155 tokens (Sandbox ASSETs) also implement ERC721, then read _transferNFTs' interface-check ordering and reasoned the ERC721 branch would be taken, ignoring numTokens.
**Exploitation:** Buyer submits an order for N tokens of a dual-standard collection; exchange transfers only one item while charging for the full order, causing buyer fund loss.
**Insight:** When a contract dispatches on ERC165 supportsInterface, check whether real tokens implement multiple interfaces; ordering of interface checks can silently change transfer semantics and quantity.