# Migration Module: Re-enter commit using custom token

Migration.commit sets isCommited after external calls; a malicious FERC1155 token reenters commit to drain ETH into the buyout module.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: zzzitron
- Disclosed: 2022-09-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/576
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:reentrancy

**Target:** Migration module commit function (Solidity smart contract)
**Root cause:** commit performs external calls (setApprovalFor, buyout.start) before setting proposal.isCommited and started, violating CEI; the FERC1155 token callback reenters commit.
**Steps:**
1. Deploy malicious FERC1155 `evil_token` whose transfer/approval callback reenters `Migration.commit`
2. Create a vault with `evil_token` and propose/join with 0.5 ETH
3. Call `commit`; during `setApprovalFor`/`buyout.start` the token reenters `commit` repeatedly
4. Each reentry forwards `proposal.totalEth` to buyout module, draining migration module ETH
**How found:** Code review of commit noticed state writes (isCommited, started) occur after external calls to token and buyout, and that a user-supplied FERC1155 token enables a callback reentry.
**Exploitation:** Attacker controls the FERC1155 token used in their vault; the token's callback reenters commit before state flags are set, causing repeated buyout.start calls funded by other users' deposited ETH in the migration module.
**Escalation:** Reentry count adjustable to drain all ETH in migration module; funds land in buyout module where same actor can drain per buyout implementation.
**Insight:** When a protocol accepts arbitrary ERC1155/ERC721 tokens, the token's approval/transfer callback is an attacker-controlled reentry vector; check ordering of state writes around setApprovalFor and any external call in commit-like flows.