# Attacker can frontrun a victim's mint+add transaction to steal NFT

mint() lets add() target any CidNFT id, so an attacker frontruns a victim's mint to claim their expected token id and capture the victim's deposited subprotocol NFTs.

- Payout: Contest reward
- Severity: high
- Program: Canto Identity Protocol
- Credited: popular00
- Disclosed: 2023-04-06
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-01-canto-identity-findings/issues/67
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-canto-identity%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** CidNFT.sol mint()/add()/remove()
**Root cause:** mint() delegatecalls add() with user-supplied _cidNFTID calldata and never binds it to the freshly minted token id; add() only checks owner/approval of the arbitrary id.
**Steps:**
1. Victim submits `mint(addList)` expecting CidNFT #100, with addList encoding `_cidNFTID=100`
2. Attacker frontruns with `mint(new bytes[](0))` receiving #100, then `setApprovalForAll(victim, true)`
3. Victim's tx executes, mints #101, but add() calldata still targets #100
4. Victim's subprotocol NFTs transfer into CidNFT #100 custody
5. Attacker calls `remove(100, ...)` to withdraw victim's NFTs
**How found:** Code review of mint()'s delegatecall loop: noticed _cidNFTID comes from calldata with no check tying it to the just-minted token, then reasoned about id prediction and frontrunning.
**Exploitation:** Attacker needs only to observe the pending mint tx and pay gas to frontrun; no capital required. By minting the victim's expected id and approving the victim, the victim's add() calls succeed against the attacker's token, depositing the victim's subprotocol NFTs which the attacker then removes.
**Insight:** When a batch function takes an id that should be implicit (the just-minted token), check whether the id is caller-supplied and unbound; predictable sequential ids plus approval checks make frontrun theft possible.