# _transferNFTs() succeeds even if no transfer is performed

Infinity's _transferNFTs silently no-ops when an NFT lacks ERC-721/1155 interface support, so buyer pays seller but receives no NFT.

- Payout: Audit contest
- Severity: high
- Program: Infinity NFT Marketplace
- Found by: k
- Disclosed: 2022-08-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-infinity-findings/issues/87
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-infinity%3AH-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NFT marketplace exchange contract _transferNFTs
**Root cause:** _transferNFTs checks supportsInterface for ERC-721/1155 and, if neither is supported, performs no transfer instead of reverting, while settlement still pays the seller.
**Steps:**
1. Deploy or list an NFT contract that returns false for both ERC-721 and ERC-1155 interface IDs in `supportsInterface()` (or is non-compliant).
2. Create a sell order for that token on Infinity.
3. Buyer fulfills the order; `_transferNFTs()` finds no supported interface and skips transfer.
4. Settlement completes: seller receives funds, buyer receives no NFT.
**How found:** Code review of the transfer path: noticed _transferNFTs branches on supportsInterface and lacks a revert when neither standard is supported, meaning the function can succeed without moving a token.
**Exploitation:** A malicious seller lists a non-compliant/malicious NFT contract; buyer pays and settlement succeeds without any NFT moving to the buyer, netting the seller the sale price.
**Insight:** In marketplace settlement code, verify that the asset-transfer branch actually asserts a transfer occurred (balance delta or revert on unsupported interface); a silent no-op branch that still releases payment is a direct funds-loss vector.