# Anyone can steal CryptoPunk during the deposit flow to WPunkGateway

WPunkGateway.supplyPunk mints nTokens to caller-chosen onBehalfOf, so anyone can front-run a CryptoPunk deposit approval and steal the punk.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: 0x52
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/137
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** WPunkGateway.supplyPunk / acceptBidWithCredit deposit flow
**Root cause:** supplyPunk pulls the punk via the pre-ERC721 offerPunkForSaleToAddress approval but lets the caller specify onBehalfOf, so the depositor and beneficiary are decoupled.
**Steps:**
1. Victim calls `Punk.offerPunkForSaleToAddress(WPunkGateway, 0, punkIndex)` to approve deposit
2. Attacker observes tx and calls `WPunkGateway.supplyPunk([punkIndex], attacker, 0)`
3. Gateway executes `Punk.buyPunk`, `Punk.transferPunk(proxy)`, `WPunk.mint`, then `Pool.supplyERC721(..., onBehalfOf=attacker)`
4. Attacker receives the nTokens representing the punk
**How found:** Recognized CryptoPunks predate ERC721 and use offerPunkForSaleToAddress as an approval primitive; noticed supplyPunk accepts arbitrary onBehalfOf without verifying punk owner equals msg.sender.
**Exploitation:** Attacker monitors mempool for the victim's offerPunkForSaleToAddress approval, then front-runs supplyPunk with onBehalfOf set to their own address, capturing the minted nTokens and thus the punk's value.
**Insight:** When a protocol wraps a pre-ERC721 asset using sale-offer approvals, check whether the deposit function binds the beneficiary to the approving owner; any caller-specified onBehalfOf enables mempool front-running theft.