# A majority attack can easily bypass Zora auction stage in OpenseaProposal and steal the NFT from the party.

Attacker bids high on Zora auction without implementing ERC721Receiver, forcing safeTransferFrom to fail and cancel auction, bypassing Zora stage to steal NFT via cheap OpenSea listing.

- Payout: Contest reward
- Severity: high
- Program: PartyDAO
- Credited: Trust
- Disclosed: 2022-11-17
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/264
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** ListOnOpenseaProposal / Zora AuctionHouse settlement
**Root cause:** _settleZoraAuction treats a cancelled auction (due to failed NFT transfer to bidder) as a graceful failure returning false, which advances the proposal to the OpenSea listing stage instead of reverting.
**Steps:**
1. Pass a ListOnOpenseaProposal with a tiny list price and execute it
2. Deploy attacker contract that bids an overpriced amount on the NFT but does not implement ERC721Receiver; call its bid()
3. Wait for auction to end (timeout after bid)
4. Deploy contract calling execute() on the proposal and immediately buys the item on Seaport; call attack function
**How found:** Code-reading of _settleZoraAuction's comment hinting auction can be cancelled by failed transfer, then tracing AuctionHouse endAuction's try/catch around safeTransferFrom and OpenZeppelin's _checkOnERC721Received requirement.
**Exploitation:** Attacker wins Zora auction with high bid; AuctionHouse endAuction calls safeTransferFrom to attacker which reverts (no ERC721Receiver), so AuctionHouse refunds bid and cancels auction, returning gracefully. _settleZoraAuction sees NFT still owned by party and returns false, advancing to OpenSea stage where attacker lists at negligible price and buys via Seaport contract, stealing NFT.
**Insight:** When a protocol uses a try/catch around an external call and treats a caught failure as a benign 'return false' to advance state, check whether an attacker can deliberately trigger that failure (e.g. by not implementing a receiver hook) to skip a security-critical stage.