# Malicious users can honeypot other users by transferring out ERC20 and ERC721 tokens right before sale

Club owner can withdraw ERC20/ERC721 assets from escrow right before sale, leaving buyer with an empty club.

- Payout: Contest reward
- Severity: high
- Program: Footium
- Credited: 0x52
- Disclosed: 2023-04-13
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-footium-judging/issues/291
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-footium%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:race-window vuln:business-logic

**Target:** FootiumEscrow smart contract (ERC20/ERC721 escrow)
**Root cause:** Escrow assets are not locked during an active club sale; the club owner retains the ability to transfer tokens out of the escrow at any time, including in the same block as the sale.
**Steps:**
1. User A owns Club 1 holding players worth 5 ETH
2. User A lists Club 1 for 2.5 ETH
3. User B submits purchase tx
4. User A observes tx in mempool and calls escrow transfer to withdraw all players before/at sale
5. Sale completes; User B receives an empty club while User A keeps the players
**How found:** Manual review noting that club ownership and escrow are separate and the owner can transfer escrow tokens at any time, including during a pending sale.
**Exploitation:** Seller front-runs the buyer's purchase transaction by calling the escrow's ERC20/ERC721 transfer functions to drain the club's assets, then lets the sale settle, capturing both the sale price and the assets.
**Insight:** When an escrow holds assets backing a sale, check whether the seller can still move those assets during the sale window; any owner-callable transfer on escrowed assets is a front-running honeypot vector.