# All orders can be hijacked to lock rental assets forever by tipping a malicious ERC20

Seaport tipping lets a fulfiller append a revert-on-transfer ERC20 to consideration, so stopRent always reverts and rented assets stay locked in escrow forever.

- Payout: Contest reward
- Severity: high
- Program: reNFT
- Credited: EV\_om
- Disclosed: 2024-03-20
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/614
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Seaport Zone Create contract / rental stop flow
**Root cause:** Order hash derivation ignores consideration items beyond totalOriginalConsiderationItems, so tips are unsigned; the zone receives all consideration items in one array with no way to distinguish tips, and the signed RentPayload does not commit to consideration items.
**Steps:**
1. Create a BASE order with Alice as offerer and finalize creation.
2. Bob builds an order fulfillment and appends a ConsiderationItem with a malicious ERC20 (reverts on transfer) to `advancedOrder.parameters.consideration`, recipient = escrow.
3. Mint/approve the malicious token to Bob and finalize the base order fulfillment; signature still validates since tips are excluded from the order hash.
4. Warp past rental expiration and call `stopRent(rentalOrder)`; it reverts with `PaymentEscrowModule_PaymentTransferFailed` because escrow transfer of the malicious token fails.
5. Rented assets remain locked in the rental safe indefinitely.
**How found:** Reading Seaport docs on tipping and the note that zones must enforce allocation of consideration extensions; traced order hash derivation to totalOriginalConsiderationItems and noticed ZoneParameters merges tips with original items indistinguishably.
**Exploitation:** Fulfiller front-runs/extends consideration with a revert-on-transfer ERC20 tip; the order still validates because the tip is outside the signed hash. On stopRent, escrow attempts to transfer the malicious token back and reverts, permanently bricking the rental and locking the NFT.
**Insight:** When auditing Seaport zones, check whether the zone can distinguish fulfiller-appended consideration tips from signed items; any unsigned item that flows into escrow/refund logic can be weaponized with a revert-on-transfer or reentrant token to brick settlement.