# Enjin CryptoItems: open registry reinit enables manager takeover drain

Unprotected initialize() on Enjin item registries let attacker re-init as manager, register malicious adapter, drain 5.23M ENJ backing.

- Payout: Real-world hack
- Severity: critical
- Program: EnjinCryptoItems
- Credited: DeFiHackLabs
- Disclosed: 2026-08-26
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-08/EnjinCryptoItems_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260826-enjincryptoitems
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** ERC-1155 item platform contract registry (Ethereum)
**Root cause:** The per-item adapter clone registries expose an unprotected initialize(uint256) with no access control, letting any address re-initialize and call acceptManager() to become registry manager.
**Steps:**
1. Call `registry.initialize(1)` on registry A and B (no access control).
2. Call `registry.acceptManager()` to become manager (ManagerUpdate fires from original manager).
3. Call `updateContract(impl, "stealNFT(address,address,uint256);", ...)` and transferFrom variant to register attacker code as adapter body.
4. Register NoopStub for initialize/acceptManager to avoid reverts on clone creation.
5. Invoke malicious adapter via clone delegatecall to call platform internal transfer selectors `0x41c1df0e` (NF) and `0xf95d7da3` (FT) with no owner-approval check.
6. Call `platform.melt(ids, values)` to redeem stolen items for ENJ backing from reserve.
**How found:** Likely source review of adapter clone delegatecall pattern revealing registries expose unprotected initialize() and acceptManager() with no access control, enabling manager takeover.
**Exploitation:** Attacker re-initialized both registries, took manager role, registered a malicious adapter body that moves items via platform internal transfer functions without approval checks, pulled 54 items from holders, and melted them for 5,231,353 ENJ (~$142K) paid to msg.sender.
**Escalation:** Two registries hijacked to cover both item adapter sets; registered no-op stubs to keep clone creation working and lock out original manager.
**Insight:** When contracts use per-item delegatecall clones backed by a registry, check whether the registry's initialize/acceptManager/updateContract functions lack access control — re-running an open initializer can hand you the manager role and let you install arbitrary adapter logic.