# Adversary can break any bounty they wish by depositing an NFT then refunding it

Refunding an NFT deposit leaves the nftDeposit receipt in place, so claiming any bounty later reverts trying to transfer an NFT the contract no longer holds, bricking payouts.

- Payout: Contest reward
- Severity: high
- Program: Openq
- Credited: 8olidity
- Disclosed: 2023-01-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-openq-judging/issues/263
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-openq%3AH-6
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** BountyCore/ClaimManagerV1 bounty contracts
**Root cause:** BountyCore#refundDeposit transfers the NFT back to the funder but never removes the deposit receipt from nftDeposits, so ClaimManagerV1 still iterates it and attempts to transfer an NFT the contract no longer owns.
**Steps:**
1. Funder deposits an NFT into a bounty, creating an nftDeposit receipt.
2. Funder calls BountyCore#refundDeposit, which transfers the NFT back but leaves the receipt in nftDeposits.
3. Any claimant calls claim on the bounty; ClaimManagerV1 loops nftDeposits and attempts to transfer the refunded NFT.
4. Transfer reverts since contract lacks the NFT, permanently breaking all payouts on that bounty.
**How found:** Code reading of refundDeposit vs claim loop: noticed refund path doesn't delete the nftDeposits entry that the claim path iterates.
**Exploitation:** Attacker funds a bounty with an NFT, immediately refunds it, leaving a stale nftDeposit receipt; every subsequent claim reverts, bricking payouts. Combined with refund-locking, deposited tokens become stuck forever.
**Escalation:** Combined with refund locking methods, all deposited tokens become permanently stuck.
**Insight:** When a deposit/refund ledger and a payout loop share state, check that every refund path deletes the receipt the payout loop iterates; a stale entry turns a benign refund into a permanent DoS on payouts.