# PARENT_CANNOT_CONTROL and CANNOT_CREATE_SUBDOMAIN fuses can be bypassed

ENS NameWrapper fuse constraints bypassed by unwrapping a parent, reclaiming registry ownership of a fused child, then re-wrapping to steal the subnode and create sub-subdomains.

- Payout: Contest reward
- Severity: high
- Program: ENS
- Credited: izhuer
- Disclosed: 2023-05-26
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-ens-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** ENS NameWrapper / ENSRegistry contract
**Root cause:** Fuse-burning checks only enforce constraints when the node is wrapped; unwrapping a parent lets the registry owner be changed, and re-wrapping re-claims a child whose PARENT_CANNOT_CONTROL/CANNOT_CREATE_SUBDOMAIN fuses were already burnt.
**Steps:**
1. Register and wrap `sub1.eth` to hacker (registry owner = NameWrapper).
2. Create `sub2.sub1.eth` with no fuses, wrapper owner = hacker.
3. Create `sub3.sub2.sub1.eth` with no fuses, owned by victim.
4. Hacker unwraps `sub2.sub1.eth` so registry owner becomes hacker.
5. Via ENSRegistry, hacker sets self as registry owner of `sub3.sub2.sub1.eth` (NameWrapper record still valid).
6. Hacker re-wraps `sub2.sub1.eth` (registry owner = NameWrapper).
7. Burn `PARENT_CANNOT_CONTROL | CANNOT_UNWRAP` on `sub2.sub1.eth`.
8. Burn `PARENT_CANNOT_CONTROL | CANNOT_UNWRAP | CANNOT_CREATE_SUBDOMAIN` on `sub3.sub2.sub1.eth` while registry owner remains hacker.
9. Call `NameWrapper::wrap` on `sub3.sub2.sub1.eth` to reclaim ownership in NameWrapper.
10. Call `ENSRegistry::setSubnodeRecord` to create `sub4.sub3.sub2.sub1.eth`, violating CANNOT_CREATE_SUBDOMAIN.
**How found:** Observed that fuse-burning guarantees only hold when CANNOT_UNWRAP is burnt and only apply to wrapped nodes; hypothesized that unwrapping a parent lets registry ownership diverge from NameWrapper state, then tested via PoC with 6 attack paths.
**Exploitation:** Malicious parent owner unwraps an intermediate node to regain registry ownership, then uses ENSRegistry to seize registry ownership of a fused descendant while its NameWrapper record persists; re-wrapping re-claims the descendant in NameWrapper, allowing theft of the victim's subnode and creation of new sub-subdomains despite burnt fuses.
**Escalation:** Chained unwrap → registry ownership takeover → re-wrap to bypass multiple fuse invariants, enabling both subnode theft and subdomain creation.
**Insight:** When a contract maintains parallel ownership state (registry vs wrapper), check whether unwrap/re-wrap transitions let you mutate the authoritative owner of a descendant whose fuse flags are already set; fuses enforced only on wrapped nodes are bypassable by toggling wrap state.