# Failed job can't be recovered. NFT may be lost.

HolographOperator deletes the operator job before a non-reverting bridge call; if that call fails, the job is unrecoverable and the bridged NFT is lost forever.

- Payout: Contest reward
- Severity: high
- Program: Holograph
- Credited: Chom
- Disclosed: 2022-12-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-holograph-findings/issues/102
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-holograph%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** HolographOperator.executeJob bridge call
**Root cause:** executeJob deletes _operatorJobs[hash] before invoking nonRevertingBridgeCall; on failure the catch block only sets _failedJobs[hash]=true, leaving no replayable job state to retry the mint.
**Steps:**
1. Call `executeJob(bridgeInRequestPayload)` as the selected operator.
2. Observe `delete _operatorJobs[hash]` executes before the bridge call.
3. Cause `nonRevertingBridgeCall` to revert (e.g. insufficient gas), entering the catch block.
4. `_failedJobs[hash]=true` is set and FailedOperatorJob emitted, but the job is already deleted.
5. Retrying executeJob is impossible; the NFT is never minted and is lost.
**How found:** Code reading of executeJob ordering: noticed the delete of the job hash precedes the try/catch bridge call, so the failure path leaves no state to retry.
**Exploitation:** Precondition: a bridge-in job whose nonRevertingBridgeCall fails (e.g. out-of-gas). The job record is deleted before the call, so neither operator nor user can replay; the asset is permanently unminted.
**Insight:** In try/catch non-blocking call patterns, check whether state needed for retry is cleared before the call; a catch that only flags failure without preserving replayable state turns a recoverable failure into permanent asset loss.