# An attacker can hijack any ERC1155 token he rents due to a design issue in reNFT via reentrancy exploitation

reNFT registers rentals only after Seaport transfers ERC1155 tokens, so a malicious Safe fallback handler reenters onERC1155Received to move rented NFTs out before the guard knows about the rental.

- Payout: Contest reward
- Severity: high
- Program: reNFT
- Credited: sin1st3r\_\_
- Disclosed: 2024-03-20
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/588
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-03
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:reentrancy

**Target:** Gnosis Safe rental safe + Seaport conduit ERC1155 transfer flow
**Root cause:** Rental registration in Create.validateOrder/_rentFromZone happens after Seaport's conduit transfers tokens; ERC1155 safeTransferFrom triggers onERC1155Received on the borrower's Safe before the rental is recorded, so the Guard does not block outgoing transfers.
**Steps:**
1. Attacker deploys a custom fallback handler implementing onERC1155Received that instructs the Safe to transfer the received ERC1155 tokens to the attacker's EOA.
2. Attacker deploys a rental Safe via factory.deployRentalSafe and calls setFallbackHandler(customHandler).
3. Attacker initiates the rental fulfillment of a lender's ERC1155 offer order through Seaport.
4. Conduit calls safeTransferFrom on the ERC1155, invoking onERC1155Received on the Safe, which delegates to the malicious fallback handler.
5. Fallback handler executes a Safe transaction moving the ERC1155 tokens to the attacker; Guard permits it because the rental is not yet registered.
6. Seaport then calls Create.validateOrder and the rental is registered, but tokens are already gone.
**How found:** Noticed that ERC1155 transfers use safeTransferFrom (triggering onERC1155Received) while ERC721 uses transferFrom, and that rental registration occurs only in the Zone callback after token swaps; combined with Gnosis Safe fallback handler flexibility this yields a reentrancy window before the Guard is aware of the rental.
**Exploitation:** Attacker rents any ERC1155 token, and during the transfer callback (before rental registration) uses the Safe's fallback handler to forward the tokens to themselves, keeping the rented NFT while the rental is recorded against them.
**Insight:** When a protocol registers state only in a post-swap Zone/callback, any token standard that invokes a receiver hook (ERC1155, ERC777, ERC721 safeTransfer) during the swap opens a pre-registration window; check whether the Safe Guard's rental lookup can be bypassed via a custom fallback handler.