# A malicious borrower can hijack any NFT with permit() function he rents.

Renter of an ERC-4494 permit NFT can self-sign a permit via their rental Safe (EIP-1271) to approve themselves and steal the rented token.

- Payout: Contest reward
- Severity: medium
- Program: reNFT
- Credited: sin1st3r\_\_
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/587
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** reNFT rental Safe / ERC-721 permit()
**Root cause:** reNFT's rental Safe does not block calls to the ERC-4494 permit() function on rented NFTs; since the Safe owns the token and validates signatures via EIP-1271, the renter (Safe owner) can authorize themselves as spender.
**Steps:**
1. Rent an ERC-4494 permit-enabled NFT into attacker's rental Safe
2. Build EIP-712 permit signature (deadline, tokenId, spender=attacker) signed by attacker key
3. Call `permit(attacker, tokenId, deadline, sig)` on the NFT; Safe validates via EIP-1271 as owner
4. permit() sets approval for attacker on the Safe-owned token
5. Call `transferFrom(safe, attacker, tokenId)` to move NFT out of the Safe
**How found:** Recognized that ERC-4494 permit() lets the token owner's signature authorize a spender, and that the rental Safe is the owner and validates signatures via EIP-1271 — so the renter controlling the Safe can self-approve.
**Exploitation:** Attacker rents a permit-enabled NFT, self-signs a permit, calls permit() which the Safe (owner) approves via EIP-1271, then transfers the NFT out of the rental Safe, defeating the rental escrow.
**Insight:** When a protocol custodies NFTs in a smart-contract wallet, enumerate token-level approval primitives (permit, setApprovalForAll via hooks) that the wallet itself can authorize; EIP-1271 makes the Safe a valid signer for its own holdings.