# Thunder Brawl: reentrancy in claimReward drains HouseWallet

Thunder Brawl HouseWallet claimReward reentered via onERC721Received callback to repeatedly claim the same game reward, draining the prize pool.

- Payout: Real-world hack
- Severity: high
- Program: Thunder Brawl
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-09/THB_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221001-thb
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:reentrancy

**Target:** HouseWallet game reward contract on BSC
**Root cause:** claimReward transfers an ERC721 reward to the player before finalizing reward state, so the onERC721Received callback can re-enter claimReward while the winners balance is still claimable.
**Steps:**
1. Call `houseWallet.shoot{value: 0.32 ether}(randomNumber, gameId, feestate, _x, name, _add, nftcheck, dystopianCheck)` to enter the game and become a winner.
2. Read `_amount = houseWallet.winners(gameId, add)`.
3. Call `houseWallet.claimReward(gameId, add, _amount, _rewardStatus, _x1, name1, _add)` with the off-chain-computed `_x1`/`name1` hash preimage.
4. In `onERC721Received`, re-read `winners(gameId, add)` and if `address(houseWallet).balance >= _amount * 2`, call `claimReward` again recursively.
**Exploitation:** Attacker funds 0.32 BNB to shoot, becomes a winner, then claims the reward; the ERC721 transfer callback re-enters claimReward repeatedly, each time re-reading the still-unzeroed winners balance, draining the HouseWallet's BNB until balance < amount*2.
**Insight:** Game contracts that pay ERC721 prizes via safeTransferFrom before zeroing the winners mapping are reentrancy targets; the callback itself can re-read the same winners() balance and re-claim.