# RentPayload's signature can be replayed

RentPayload signatures lack a nonce/orderHash, so an unexpired signature can be replayed to fulfill multiple PAY orders sharing identical metadata, capturing rental earnings.

- Payout: Contest reward
- Severity: medium
- Program: reNFT
- Credited: 0xpiken
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/162
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:signature-replay

**Target:** Seaport zone Create#validateOrder signature verification
**Root cause:** RentPayload contains no unique field (nonce/orderHash), so signature verification only checks expiration and protocol signer; identical OrderMetadata yields identical payloads and reusable signatures.
**Steps:**
1. Create multiple PAY orders from different lenders with identical OrderMetadata (same orderType, rentDuration, hooks, emittedExtraData).
2. Observe extraData (payload+signature) is byte-identical across these orders via `console.logBytes(ordersToFulfill[i*2].advancedOrder.extraData)`.
3. Reuse one unexpired payload/signature to fulfill all matching PAY orders.
4. Collect rental earnings for each fulfilled order.
**How found:** Reading RentPayload struct and Create#validateOrder flow, noticed no used-signature tracking and that OrderMetadata is simple enough that distinct orders can collide, then confirmed via test logging identical extraData.
**Exploitation:** Attacker reuses a single valid signed RentPayload to fulfill every PAY order whose metadata hash matches the zonehash, receiving fulfiller earnings repeatedly without distinct authorizations.
**Insight:** When a signed payload is validated only by expiration + signer + a hash of a small metadata struct, check whether that struct can collide across orders; log extraData across orders to confirm signature reuse.