# If PARENT_CANNOT_CONTROL is set on subdomain, it can be unwrapped then wrapped by its owner and then parent can control it again before the expiry

Burning only PARENT_CANNOT_CONTROL on a subdomain lets its owner unwrap/rewrap to clear the fuse, letting the parent regain control before expiry.

- Payout: Contest reward
- Severity: medium
- Program: ENS
- Credited: panprog
- Disclosed: 2022-12-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-ens-findings/issues/119
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-ens%3AM-07
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** NameWrapper.sol fuse logic (ENS subdomain wrapper)
**Root cause:** _canFusesBeBurned allows burning PARENT_CANNOT_CONTROL without CANNOT_UNWRAP; unwrapping then rewrapping resets fuses and expiry, so the parent-control limitation is lost.
**Steps:**
1. Alice registers and wraps `test.eth`
2. Alice creates `bob.test.eth`, burns `PARENT_CANNOT_CONTROL` with max expiry, transfers to Bob
3. Bob unwraps `bob.test.eth`
4. Bob rewraps `bob.test.eth`, clearing fuses and expiry
5. Alice reassigns `bob.test.eth` ownership to herself before expiry
**How found:** Code reading of _canFusesBeBurned revealed PARENT_CANNOT_CONTROL could be burned alone without CANNOT_UNWRAP, and reasoning that unwrap+rewrap clears fuses.
**Exploitation:** Victim (subdomain owner) must unwrap and rewrap their own domain; the parent then reassigns ownership, breaking the guarantee that the subdomain was secure until expiry. Requires the parent to turn malicious.
**Insight:** When a fuse/flag is meant to be irreversible, check whether any path (unwrap/rewrap, transfer, re-registration) recreates the record and resets it; irreversible guarantees need a companion lock preventing the reset path.