# NameWrapper: Cannot prevent transfer while upgrade even with CANNOT_TRANSFER fuse regardless of the upgraded NameWrapper's implementation

NameWrapper upgradeETH2LD/upgrade burns the node then lets caller pass arbitrary wrappedOwner, bypassing CANNOT_TRANSFER fuse and transferring a locked name.

- Payout: Contest reward
- Severity: medium
- Program: ENS
- Credited: zzzitron
- Disclosed: 2023-05-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-ens-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NameWrapper.sol upgradeETH2LD/upgrade contract functions
**Root cause:** _prepareUpgrade burns the node before calling the upgraded NameWrapper, so the old owner is lost; the upgraded contract trusts the user-supplied wrappedOwner and cannot verify it matches the prior owner, ignoring the CANNOT_TRANSFER fuse.
**Steps:**
1. Wrap vitalik.eth via `wrapETH2LD('vitalik', user1, type(uint16).max, address(0))` burning all fuses including CANNOT_TRANSFER.
2. Owner calls `setUpgradeContract(nameWrapperUpgrade)`.
3. user1 calls `upgradeETH2LD('vitalik', address(123), address(531))` with a new owner.
4. _prepareUpgrade burns the node, then upgradeContract.wrapETH2LD sets owner to the supplied wrappedOwner, transferring despite the fuse.
**How found:** Code review of upgradeETH2LD/upgrade and _prepareUpgrade: noticed the node is _burned before the upgraded wrapper is invoked, so the old owner is unrecoverable and the new owner is taken from user input; wrote a Foundry PoC to confirm.
**Exploitation:** A holder of a name with CANNOT_TRANSFER burned (or an attacker who gains temporary control) can call upgradeETH2LD/upgrade with an arbitrary wrappedOwner during an upgrade window, moving the name to a new address despite the transfer lock.
**Insight:** When a contract migrates state by burning then re-minting in a new contract, any fuse/lock enforced only by the old contract is lost unless the new contract re-derives the prior owner from the old contract before burn; check upgrade/migration paths for fuse bypass.