# Currently auctioned NFTs can be transferred to a different address in a specific edge case

Auctioned NFT could be minted to another address mid-auction, causing collateral credited to the new owner while only fee was paid, enabling ETH theft.

- Payout: Contest reward
- Severity: medium
- Program: Radicalxchange
- Credited: zzykxx
- Disclosed: 2024-02-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-radicalxchange-judging/issues/33
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-radicalxchange%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** EnglishPeriodicAuction and StewardLicenseBase smart contracts
**Root cause:** Protocol assumes NFT owner cannot change during auction, but mintToken() allows transferring an unminted NFT with a past tokenInitialPeriodStartTime, changing ownership mid-auction.
**Steps:**
1. Add NFT to collection with `to=address(0)` and `tokenInitialPeriodStartTime` such that `0 < tokenInitialPeriodStartTime < l.initialPeriodStartTime` and current time is between them.
2. As initialBidder, call `placeBid()` on the NFT, paying only the ETH fee (not full bid) because caller is NFT owner.
3. Call `mintToken()` to transfer NFT to another controlled address.
4. Call `closeAuction()`; since NFT owner changed, `availableCollateral[oldBidder] += bidAmount` credits the new address with the full bid amount.
5. Call `withdrawCollateral()` from the new address to extract ETH, while retaining the NFT license.
**How found:** Manual review identified edge case where mintToken() can change NFT ownership during auction due to tokenInitialPeriodStartTime being set before license initialPeriodStartTime.
**Exploitation:** Attacker with initialBidder role and ability to add NFT with past start time bids with only fee, transfers NFT to second address, closes auction to credit collateral to second address, then withdraws ETH.
**Escalation:** If ADD_TOKEN_TO_COLLECTION_ROLE is also malicious, can drain all protocol funds.
**Insight:** Check for state changes that violate invariants assumed by auction logic, especially around ownership and timing parameters that can be set to past values.