# Incorrect ordering for deletion allows to flash steal rented NFT's

reNFT Stop.sol transfers rented NFT before verifying order existence, letting attacker flash-borrow NFT via reentrant order creation and bypass lender hook restrictions.

- Payout: Contest reward
- Severity: medium
- Program: reNFT
- Credited: hash
- Disclosed: 2024-03-20
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/466
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-06
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:reentrancy

**Target:** Stop.sol stopRent rental escrow contract
**Root cause:** stopRent calls _reclaimRentedItems (which transfers the ERC721/1155 and triggers onReceived callback) before STORE.removeRentals verifies the order exists, so a non-existent order can be created mid-callback.
**Steps:**
1. Attacker rents restricted NFT N via reNFT.
2. Call `stopRent` with a non-existent PAY order whose offer item is NFT N and creator is attacker-controlled contract.
3. `_reclaimRentedItems` transfers NFT N to attacker contract, invoking `onReceived`.
4. In callback, attacker uses NFT freely, bypassing lender hook restrictions.
5. Attacker creates and fills the order in Seaport (using pre-obtained or replayed server signature) to populate orderHash.
6. stopRent resumes; `STORE.removeRentals` now finds valid order and does not revert.
**How found:** Code reading of stopRent ordering: noticed _reclaimRentedItems transfer precedes STORE.removeRentals existence check, and that ERC721/1155 transfers invoke onReceived callbacks enabling reentrancy to create the order mid-execution.
**Exploitation:** Attacker rents a restricted NFT, then calls stopRent with a fabricated PAY order. During the ERC721 onReceived callback the attacker freely uses the NFT (e.g. calling game contracts the lender forbade), then creates/fills the order in Seaport so the existence check passes. NFT returns to rental safe at end of tx, so no direct fund loss but restrictions bypassed.
**Insight:** In escrow/rental protocols, check order existence and state before any external token transfer; ERC721/1155 onReceived callbacks are reentrancy vectors that can populate mappings the later check relies on.