# Incorrect gnosis_safe_disable_module_offset constant leads to removing the rental safe's module without verification

Wrong calldata offset in reNFT's Guard made disableModule verify prevModule instead of module, letting a whitelisted prevModule remove any module unverified.

- Payout: Contest reward
- Severity: high
- Program: reNFT
- Credited: serial-coder
- Disclosed: 2024-03-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/565
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Gnosis Safe Guard policy (Guard.sol) in reNFT rental safe
**Root cause:** gnosis_safe_disable_module_offset was set to 0x24 (prevModule, first param) instead of 0x44 (module, second param), so Guard::_checkTransaction extracts and whitelist-checks the wrong address.
**Steps:**
1. Note disableModule(address prevModule, address module) selector 0xe009cfde; calldata layout: 4-byte selector + 32-byte prevModule + 32-byte module.
2. Observe constant gnosis_safe_disable_module_offset = 0x24 = 32+4, pointing at prevModule.
3. Craft safe tx calling disableModule(prevModule=whitelistedExtension, module=targetModule).
4. Guard::_checkTransaction loads extension at offset 0x24 -> prevModule, passes _revertNonWhitelistedExtension since prevModule is whitelisted.
5. Target module is removed without being whitelist-verified.
**How found:** Code review of the calldata offset constant against the actual disableModule signature; noticed 0x24 = 32+4 points at the first param, and that unit tests encoded disableModule with a single argument, masking the bug.
**Exploitation:** A safe transaction from a rental safe calls disableModule with a whitelisted prevModule and an arbitrary module; the Guard checks prevModule's whitelist status and lets the call through, removing the unverified module (e.g. the protocol's Stop policy contract).
**Escalation:** Removing a critical module such as the Stop policy can disable protocol safety controls, enabling further attacks.
**Insight:** When a guard parses calldata by hardcoded offsets, verify each offset against the real ABI layout (4 + 32*n); also check that tests encode the full multi-arg signature, since single-arg test calldata hides offset bugs.