#  Blocklisting in payment ERC20 can cause rented NFT to be stuck in Safe

Blocklisted renter in a PAY order makes Stop.stopRent revert on ERC20 settlement, leaving the rented NFT stuck in the renter's Safe and payment locked in escrow.

- Payout: Contest reward
- Severity: medium
- Program: reNFT
- Credited: stackachu
- Disclosed: 2024-03-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-renft-findings/issues/64
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AM-15
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Stop.sol stopRent / PaymentEscrow.settlePayment ERC20 transfer
**Root cause:** stopRent atomically returns the NFT and settles ERC20 payment via _safeTransfer; if any recipient or the escrow is blocklisted in the payment token, the transfer reverts and the whole stopRent reverts, so the NFT cannot be returned.
**Steps:**
1. Add blocklist mapping and revert-on-blocklist transfer/transferFrom to MockERC20.
2. Blocklist the renter (bob) via `setBlock(bob.addr, true)`.
3. Create and fulfill a PAY order where bob rents alice's ERC721 paying ERC20.
4. Warp past rental expiration.
5. Call `stop.stopRent(payRentalOrder)` as alice; expect revert `PaymentEscrowModule_PaymentTransferFailed(erc20, bob, 100)`.
6. Observe ERC721 still owned by bob's Safe, order still in STORE, payment still in escrow.
**How found:** Reasoned about external ERC20 blocklisting behavior (USDC/USDT freeze) interacting with atomic stopRent that both returns NFT and settles payment; noted a blocklisted renter can still initiate a rental but not be paid, so stop reverts.
**Exploitation:** A blocklisted (e.g. USDC/USDT-sanctioned) address rents a PAY order NFT; since blocklisting doesn't prevent starting the rental, the lender can never call stopRent to reclaim the NFT because settlement to the blocklisted renter reverts, griefing the lender for only gas cost.
**Insight:** When a single function atomically moves an NFT and settles a payment token, consider tokens with transfer restrictions (blocklists, pauses, hooks) — a reverting payout bricks the asset return; check whether the payer/payee can be blocklisted before the flow starts.