# During the deprecation period where both .eth registrar controllers are active, a crafted hack can be launched and cause the same malicious consequences of [H-01] even if [H-01] is properly fixed

During ENS dual-controller deprecation, re-registering an expired wrapped .eth name via the old registrar implicitly unwraps it, letting an attacker reclaim subdomains owned by victims.

- Payout: Contest reward
- Severity: high
- Program: ENS
- Credited: izhuer
- Disclosed: 2023-05-26
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-11-ens-findings/issues/16
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AH-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** ENS NameWrapper / BaseRegistrar / .eth registrar controllers
**Root cause:** Two active .eth registrar controllers during deprecation allow an ETH2LD to be implicitly unwrapped while NameWrapper state stays valid; registry owner and wrapper owner diverge, so reclaiming the registry owner lets the attacker re-take subnodes.
**Steps:**
1. Register and wrap `sub1.eth` with `CANNOT_UNWRAP` burnt via `NameWrapper.registerAndWrapETH2LD`.
2. Advance past expiry + grace period.
3. Re-register `sub1.eth` to attacker via old `BaseRegistrar.register` (implicitly unwraps; registry owner = attacker, wrapper still valid).
4. Call `EnsRegistry.setOwner(wrappedTokenId1, NameWrapper)` to bypass H-01 patch checks.
5. Create `sub2.sub1.eth` for victim via `NameWrapper.setSubnodeOwner` with `PARENT_CANNOT_CONTROL | CANNOT_UNWRAP`.
6. Call `BaseRegistrar.reclaim(labelHash1, hacker)` to become registry owner of `sub1.eth` again.
7. Call `EnsRegistry.setSubnodeOwner` to seize `sub2.sub1.eth`, then `NameWrapper.wrap` to re-claim wrapper ownership.
**How found:** Read ENS wrapper docs noting both controllers active during deprecation; reasoned that old controller registers without wrapping, causing registry/wrapper owner divergence, then traced reclaim + setSubnodeOwner to subnode theft.
**Exploitation:** Attacker waits for their own wrapped ETH2LD to expire, re-registers it through the legacy controller to force an implicit unwrap, then reclaims registry ownership and uses setSubnodeOwner + wrap to steal subdomains previously sold to victims with PARENT_CANNOT_CONTROL.
**Escalation:** Attack can be launched any time after the deprecation-period re-registration, not only during it; bypasses the H-01 fix.
**Insight:** When a protocol migrates between two write paths, look for state divergence between the legacy path (no wrapping) and new path (auto-wrap); expired-name re-registration plus reclaim is a reliable way to desync registry vs wrapper ownership.