# Player can mint more fighter NFTs during claim of rewards by leveraging reentrancy on the claimRewards() function

Reentrancy in MergingPool.claimRewards lets a contract winner mint extra fighter NFTs beyond their owed rewards by reentering during ERC721 mint callback.

- Payout: Contest reward
- Severity: high
- Program: AI Arena
- Credited: DarkTower
- Disclosed: 2024-05-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-ai-arena-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-ai-arena%3AH-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:reentrancy

**Target:** MergingPool.claimRewards
**Root cause:** claimRewards updates numRoundsClaimed after minting NFTs via _mintFromMergingPool, allowing a contract winner to reenter and claim again before state is updated.
**Steps:**
1. Deploy attacker contract implementing IERC721Receiver.
2. Attacker contract calls MergingPool.claimRewards with valid modelURIs, modelTypes, customAttributes.
3. During NFT mint, onERC721Received is called; attacker reenters claimRewards recursively.
4. Repeat until roundId limit reached; each reentry mints additional NFTs.
5. Attacker ends up with more NFTs than owed (e.g., 6 instead of 3 for roundId 3).
**How found:** Researcher noticed that claimRewards mints NFTs before updating numRoundsClaimed, and that a contract winner could reenter via onERC721Received to mint extra NFTs.
**Exploitation:** Attacker contract wins a round, then calls claimRewards; during ERC721 mint callback, it reenters claimRewards multiple times, each time minting more NFTs before numRoundsClaimed is updated, resulting in excess NFTs.
**Insight:** When auditing reward-claiming functions that mint NFTs, check if state updates occur after external calls; a contract winner can reenter via ERC721 receiver callback to mint extra NFTs.