# NameWrapper: Wrapped to Unregistered to ignore PARENT_CANNOT_CONTROL

NameWrapper unwrap to unregistered state lets a parent override PARENT_CANNOT_CONTROL and seize a child subnode before expiry.

- Payout: Contest reward
- Severity: medium
- Program: ENS
- Credited: zzzitron
- Disclosed: 2023-05-26
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-ens-findings/issues/8
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-ens%3AM-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** NameWrapper.sol setSubnodeRecord/unwrap
**Root cause:** setSubnodeRecord only enforces PARENT_CANNOT_CONTROL when ENS.owner(subnode) is nonzero; unwrapping to address(0) makes the node appear unregistered, so the parent check is skipped.
**Steps:**
1. Wrap vitalik.eth with CANNOT_UNWRAP via wrapETH2LD
2. setSubnodeOwner(parent,'sub1',user2,PARENT_CANNOT_CONTROL,expiry)
3. Confirm parent setSubnodeRecord reverts with OperationProhibited
4. As child owner call `nameWrapper.unwrap(parent_node,_hashLabel('sub1'),address(ens))` so ens.owner(sub1_node)==address(0)
5. Parent calls `setSubnodeRecord(parent_node,'sub1',address(246),address(12345),111111,0,0)` — succeeds despite PCC
6. New owner calls setFuses to add CANNOT_UNWRAP
**How found:** Code-reading of setSubnodeRecord's owner==address(0) branch: noticed it only checked CANNOT_CREATE_SUBDOMAIN, not PARENT_CANNOT_CONTROL, then constructed a Foundry PoC driving the node to unregistered state via unwrap.
**Exploitation:** Child owner burns/unregisters subnode (sets ENS owner to zero) believing it locked until expiry; parent then re-creates the subnode via setSubnodeRecord, taking ownership, resolver and TTL control over the PCC-protected name.
**Insight:** When access checks branch on registry owner==0 to mean 'unregistered', any path that zeroes the registry owner (unwrap/burn) reopens parent control over fuse-protected names; test fuse invariants across unregister transitions.