# Escrow approvals are not cleared when club is transferred allowing for abuse after transfer

FootiumEscrow ERC20/ERC721 approvals persist across club NFT transfers, letting a seller drain players and tokens after selling the club.

- Payout: Contest reward
- Severity: high
- Program: Footium
- Credited: 0x52
- Disclosed: 2023-04-13
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-footium-judging/issues/289
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-footium%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FootiumEscrow smart contract (ERC20/ERC721 approvals)
**Root cause:** Escrow approvals are stored on the escrow contract and are not revoked when the club NFT changes owner, so prior owner's approvals remain valid.
**Steps:**
1. User A owns clubId=1 and calls escrow approve to grant themselves allowance over club's ERC20/ERC721 assets
2. User A transfers/sells clubId=1 to User B
3. Approvals persist on FootiumEscrow
4. User A calls transferFrom on escrow to drain players and tokens now owned by User B
**How found:** Code review of FootiumEscrow approve functions noting no hook to clear approvals on club ownership change.
**Exploitation:** Seller pre-approves themselves on the escrow, sells the club, then uses the stale allowance to transfer out all ERC721 players and ERC20 tokens held by the escrow for the new owner.
**Insight:** When an escrow/vault is bound to a transferable NFT, check whether token approvals are scoped to the NFT owner and cleared on transfer; stale allowances survive ownership changes.