# ERC4626KYCDaoForm contract cannot hold kycdDAO NFT which breaks the core

ERC4626KYCDaoForm can never hold the non-transferable kycDAO NFT nor receive ERC721s, so hasKYC() always fails and the vault form is unusable.

- Payout: Contest reward
- Severity: high
- Program: Superform Erc1155a
- Credited: 0xhuy0512
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.1.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** ERC4626KYCDaoForm.sol vault adapter contract
**Root cause:** The form requires holding a kycDAO NFT to pass kycDAO4626.hasKYC(), but the NFT is non-transferable and mintable only to msg.sender, and the contract lacks ERC721Receiver and any mintWithCode() call.
**Steps:**
1. Read ERC4626KYCDaoForm.sol L12/L31: deposit/withdraw paths gated by kycDAO4626.hasKYC() modifier.
2. Observe kycDAO NFT has no transfer function and mintWithCode() mints only to msg.sender.
3. Confirm ERC4626KYCDaoForm implements no onERC721Received and no mint call.
4. Conclude hasKYC() can never return true for the contract, blocking all deposits/withdrawals.
**How found:** Code reading of the form contract against the kycDAO NFT's transfer/mint semantics and ERC721 receiver requirements; noticed the required NFT could never be acquired by the contract.
**Insight:** When a contract's access gate depends on holding an external NFT, verify the NFT's transferability and mint recipient rules plus ERC721Receiver support — non-transferable, caller-minted NFTs silently brick adapters.