# PARENT_CANNOT_CONTROL can be bypassed by maliciously unwrapping parent node

NameWrapper fails to burn CANNOT_UNWRAP on a parent when a child burns PARENT_CANNOT_CONTROL, letting a parent unwrap and re-wrap to seize the child's ownership and fuses.

- Payout: Contest reward
- Severity: high
- Program: ENS
- Credited: PwnedNoMore
- Disclosed: 2022-12-13
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-07-ens-findings/issues/173
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AH-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** NameWrapper.sol / ENSRegistry.sol smart contracts
**Root cause:** When a subdomain burns PARENT_CANNOT_CONTROL, the parent node does not burn CANNOT_UNWRAP, so the parent can still unwrap itself and re-register the subnode via ENSRegistry.setSubnodeOwner.
**Steps:**
1. Owner of poc.eth grants hack.poc.eth to attacker without CANNOT_UNWRAP; attacker burns PARENT_CANNOT_CONTROL on hack.poc.eth
2. Attacker grants victim.hack.poc.eth to victim; victim burns PARENT_CANNOT_CONTROL (and other fuses)
3. Attacker unwraps hack.poc.eth, becoming ENS owner of the node
4. Attacker calls `ENSRegistry.setSubnodeOwner(hack.poc.eth, victim)` to reassign ENS ownership of victim.hack.poc.eth to himself
5. Attacker calls `NameWrapper.wrap(victim.hack.poc.eth)` to overwrite fuses and wrapper owner of the sub-subdomain
**How found:** Code review of NameWrapper wrap/unwrap and ENSRegistry.setSubnodeOwner, noticing the fuse invariant (child PARENT_CANNOT_CONTROL implies parent CANNOT_UNWRAP) is not enforced to root.
**Exploitation:** Attacker who owns a parent name unwraps it, then uses ENSRegistry.setSubnodeOwner to reclaim the child node and re-wraps it, resetting the victim's fuses and owner despite PARENT_CANNOT_CONTROL being burned.
**Insight:** When a wrapper enforces a child-side fuse that constrains the parent, verify the parent's own fuse state is updated transitively; unwrap/re-wrap cycles can reset child state if the parent can still be unwrapped.