# NFTTrader reentrancy lets attacker steal approved NFTs

NFTTrader lacked reentrancy protection in editCounterPart, letting attacker reenter during NFT transfer to swap victim's approved NFTs for worthless ones.

- Payout: Real-world hack
- Severity: critical
- Program: NFTTrader
- Analysis by: DeFiHackLabs
- Disclosed: 2023-12-16
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-12/NFTTrader_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231216-nfttrader
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:reentrancy

**Target:** NFT swap contract
**Root cause:** editCounterPart lacks reentrancy guard and can be called during onERC721Received callback, allowing attacker to change the counterparty to a victim who has approved NFTTrader, then complete the swap to receive victim's NFTs.
**Steps:**
1. Attacker mints a UniV3 position NFT and approves NFTTrader.
2. Attacker creates a swap intent offering their UniV3 NFT and requesting a victim's CloneX NFT, with counterparty set to attacker.
3. Attacker calls closeSwapIntent, triggering transfer of attacker's NFT to NFTTrader.
4. During onERC721Received callback, attacker calls `editCounterPart(swapId, victim)` to change counterparty to victim.
5. Swap completes, transferring victim's CloneX NFT to attacker because victim had approved NFTTrader.
6. Repeat for each desired NFT.
**Exploitation:** Attacker used a malicious contract implementing onERC721Received to reenter editCounterPart during closeSwapIntent, changing the counterparty to a victim with prior approval to NFTTrader, then completing the swap to receive the victim's NFTs.
**Escalation:** Repeated the attack for multiple NFTs (5 CloneX tokens) in a loop, stealing ~$3M worth.
**Insight:** Look for reentrancy in NFT swap contracts where callback hooks (onERC721Received) can call state-changing functions like editCounterPart that alter counterparty or swap parameters.