# It is possible to create fake ERC1155 NameWrapper token for subdomain, which is not owned by NameWrapper

Reentrancy in NameWrapper._transferAndBurnFuses lets a subdomain owner unwrap during onERC1155Received, creating a detached fake ERC1155 token usable to scam buyers.

- Payout: Contest reward
- Severity: high
- Program: ENS
- Credited: panprog
- Disclosed: 2022-12-13
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-07-ens-findings/issues/84
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reentrancy

**Target:** NameWrapper.sol ERC1155 subdomain wrapper (setSubnodeOwner/setSubnodeRecord)
**Root cause:** _transferAndBurnFuses calls _transfer (which invokes onERC1155Received on the new owner) before setting new owner and fuses; the callback can unwrap the name, so ownership/fuses are written for a name NameWrapper no longer owns in the ENS registry.
**Steps:**
1. Account1 registers and wraps `test.eth`.
2. Account1 calls `NameWrapper.setSubnodeOwner` for `sub.test.eth` with Account1 as owner so NameWrapper owns the subdomain.
3. Deploy `Contract1` whose `onERC1155Received` calls unwrap and then sends the ERC1155 token back to Account1.
4. Account1 calls `NameWrapper.setSubnodeOwner` for `sub.test.eth` with `Contract1` as new owner; during `_transfer` the callback unwraps, then NameWrapper still writes fuses/ownership to Contract1.
5. Account1 calls Contract1 to send the ERC1155 token back to self, yielding a NameWrapper token for a name NameWrapper no longer owns.
**How found:** Code reading of _transferAndBurnFuses ordering: _transfer triggers the ERC1155 receiver callback before _setFuses/owner update, suggesting state can be mutated mid-transfer (classic ERC1155 reentrancy).
**Exploitation:** Attacker sells the detached ERC1155 subdomain to a buyer, burning PARENT_CANNOT_CONTROL to imply the parent cannot reclaim it; after payment the attacker re-wraps the name, overwriting the ownership record with clear fuses and attacker ownership, stealing the domain back. Also usable to fool contracts implementing onERC1155Received into believing they received the domain.
**Escalation:** Detached NameWrapper ownership from ENS registry ownership enables theft from secondary buyers and deception of ERC1155-receiving contracts.
**Insight:** ERC1155/721 receiver callbacks fire mid-function; check whether ownership/fuse state is written after the external call and whether the callback can unwrap or re-register the token to desync wrapper state from the underlying registry.