# Lender of a PAY order lending can grief renter of the payment

Malicious lender's wallet reverts onERC721Received, blocking stopRent so renter's PAY payment stays escrowed as griefing leverage.

- Payout: Contest reward
- Severity: medium
- Program: reNFT
- Credited: stackachu
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/65
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-14
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Stop.sol stopRent / Reclaimer.sol reclaimRentalOrder
**Root cause:** stopRent reclaims the NFT via safeTransferFrom to the lender's wallet; a reverting onERC721Received/onERC1155BatchReceived callback makes the whole stopRent revert, leaving payment stuck in escrow.
**Steps:**
1. Deploy lender wallet contract whose onERC721Received reverts when a toggle is set.
2. Lender creates a PAY order (lends NFT, pays renter) with this wallet as offerer.
3. Renter fulfills via PAYEE order; NFT goes to renter Safe, payment to escrow.
4. Lender flips toggle so onERC721Received reverts.
5. Renter calls stop.stopRent(); reclaimRentalOrder's safeTransferFrom reverts with StopPolicy_ReclaimFailed.
6. Payment remains in ESCRW, NFT remains in renter Safe; lender can release anytime by toggling back.
**How found:** Code-reading of Reclaimer.reclaimRentalOrder using safeTransferFrom and noticing the recipient callback can revert, blocking the entire stopRent flow.
**Exploitation:** Lender holds renter's escrowed payment hostage by making NFT return revert; can demand ransom payment from renter to re-enable the callback, with no risk since they can release at will.
**Insight:** When a protocol returns assets via safeTransferFrom to a user-controlled address, that recipient's receiver callback is an attacker-controlled revert switch that can freeze the counterparty's escrowed funds; check every safeTransferFrom to externally-owned/attacker contracts in settlement paths.