# uniclyNFT PointFarm: reentrancy inflates points to redeem NFT

Reentrancy in uniclyNFT PointFarm deposit inflates ERC1155 point balance, letting attacker redeem a Realm NFT from PointShop for ~1 NFT stolen.

- Payout: Real-world hack
- Severity: medium
- Program: uniclyNFT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-09-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-09/uniclyNFT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230916-uniclynft
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:accounting-error vuln:reentrancy

**Target:** PointFarm ERC1155 deposit/withdraw and PointShop redeem
**Root cause:** PointFarm.deposit mints/credits points and calls onERC1155Received before finalizing balance accounting, so a reentrant deposit(0,0) loop inflates the attacker's point balance.
**Steps:**
1. Acquire uJENNY via WETH swap on uJENNY/WETH pair.
2. Approve PointFarm and call `PointFarm.deposit(0, uJENNY.balanceOf(this))` to seed a position.
3. Wait ~2 days (roll to block 18149401) for points to accrue.
4. Call `PointFarm.deposit(0, 0)`; the ERC1155 receive hook reenters `PointFarm.deposit(0, 0)` while `PointFarm.balanceOf(this,0) <= 10000`, inflating points.
5. Withdraw initial uJENNY and swap back to WETH.
6. Call `PointFarm.setApprovalForAll(PointShop, true)` then `PointShop.redeem(uJENNY, 0)` to claim Realm NFT id 4689.
**Exploitation:** Attacker seeded a uJENNY deposit, waited for point accrual, then triggered a reentrant deposit(0,0) loop via onERC1155Received to inflate PointFarm point balance, withdrew principal, and redeemed the inflated points for Realm NFT 4689 at PointShop.
**Insight:** ERC1155 receive hooks fire mid-deposit; check whether point/balance accounting is finalized before the callback so a zero-amount deposit can reenter and multiply credited points.