NBLGAME (NblNftStake) Exploit — ERC721 `onERC721Received` Reentrancy Double-Withdraw

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2024-01-NBLGAME_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/NBLGAME_exp.sol.

Vulnerability classes: vuln/reentrancy/cross-function · vuln/logic/incorrect-order-of-operations

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder (the umbrella DeFiHackLabs repo contains several unrelated PoCs that do not whole-compile, so this one was extracted). Full verbose trace: output.txt. Verified vulnerable source: NblNftStake.sol.

Key info#

TL;DR#

NblNftStake.withdrawNft() returns a slot's staked NFT and staked NBL to the caller, but it performs the asset transfers before it clears the slot's stored amounts (NblNftStake.sol:1903-1932). The very first transfer it does is nft.safeTransferFrom(address(this), msg.sender, tokenid), which invokes the recipient's onERC721Received hook while stakes[_index].nblStakeAmount is still set to the full deposit. withdrawNft is not nonReentrant (the contract inherits ReentrancyGuard but never applies the modifier here).

The attacker:

1. Flash-borrows the stake contract's entire NBL balance (1,773,100,000 NBL) from the NBL/USDT V3 pool.
2. Opens a slot (unlockSlot), deposits a borrowed NFT (depositNft), and deposits all 1.7731e9 NBL into that slot (depositNbl).
3. Calls withdrawNft(0). Inside the resulting onERC721Received, it re-enters withdrawNft(0) — which re-reads the stale, still-nonzero nblStakeAmount and pays the deposit out a second time, then re-stakes the NFT so the outer call can complete.
4. The outer call then pays the same deposit out again, using the amount it cached in a local before the external call.

Result: the attacker deposited 1.7731e9 NBL once and withdrew it twice (3.5462e9 NBL out). The extra ~1.7731e9 NBL came straight out of the stake contract's NBL treasury. The attacker repaid the flash loan and swapped the surplus into 164,967.66 USDT + 6.90 WETH (~$180K).

Background — what NblNftStake does#

NblNftStake (source) is the staking hub of the NBLGAME GameFi protocol on Optimism. Each user owns up to 8 "slots" (:1652), each holding one game NFT, an optional inscription NFT, and an amount of the NBL reward token. Per-slot "power" feeds an external stakebook that distributes rewards.

The relevant slot record is a StakeInfo (:1637-1642):

struct StakeInfo {
    uint256 nftTokenId;
    uint256 inscriptionId;
    uint256 nblStakeAmount;   // ← the value double-counted by the reentrancy
    uint256 begin;
}
mapping(address => StakeInfo[]) public userStakeInfo;

A user's flow is: unlockSlot() to create a slot, depositNft(tokenId, index) to stake an NFT, depositNbl(index, amount) to stake NBL into that slot, and withdrawNft(index) to take everything back. The NBL the contract holds (1,773,100,000 NBL at the fork block — confirmed by the NBL.balanceOf(NblNftStake) reads at output.txt L61-62, L95-96) is what backs every user's nblStakeAmount. That balance is the prize.

The vulnerable code#

withdrawNft — interactions happen before effects#

function withdrawNft(uint256 _index) public {                       // ← NO nonReentrant
    StakeInfo[] storage stakes = userStakeInfo[msg.sender];
    require(_index < stakes.length, "invalid stake index");

    uint tokenid = stakes[_index].nftTokenId;
    require(tokenid > 0, "no stake available");

    uint amount = stakes[_index].nblStakeAmount;                    // ① cache full deposit (1.7731e27)
    uint power  = getSlotPower(msg.sender, _index);

    nft.safeTransferFrom(address(this), msg.sender, tokenid);       // ② EXTERNAL CALL → onERC721Received
    if (stakes[_index].inscriptionId > 0) {
        inscription.safeTransferFrom(address(this), msg.sender, stakes[_index].inscriptionId);
    }

    uint discount = calcDiscount(stakes[_index].begin, amount);
    nbl.safeTransfer(community, discount);
    nbl.safeTransfer(msg.sender, SafeMath.sub(amount, discount));   // ③ pay out the CACHED amount

    uint multiply = slotPowerMultiplies[stakes.length - 1];
    power = SafeMath.mul(power, multiply) / 100;
    stakebook.withdraw(msg.sender, power);

    stakes[_index].nftTokenId     = 0;                              // ④ EFFECTS — far too late
    stakes[_index].inscriptionId  = 0;
    stakes[_index].nblStakeAmount = 0;
    stakes[_index].begin          = 0;

    emit WithdrawNft(msg.sender, tokenid);
}

(NblNftStake.sol:1903-1932)

The ordering is interactions before effects: the NFT transfer at ② hands control to the attacker while stakes[_index].nblStakeAmount still holds the full deposit, and the slot is not zeroed until ④. Because nft.safeTransferFrom is the first thing done, the re-entry window is wide open before any payout or state change.

The guard exists but is never used#

contract NblNftStake is Ownable, ReentrancyGuard, ERC721Holder {   // ← ReentrancyGuard inherited

(NblNftStake.sol:1628)

NblNftStake inherits OpenZeppelin's ReentrancyGuard (:24-79) — the nonReentrant modifier is available — but not a single state-changing function applies it. depositNft, depositNbl, and withdrawNft are all unguarded.

Re-deposit path used to satisfy the outer call#

function depositNft(uint256 _tokenid, uint256 _index) public {
    StakeInfo[] storage stakes = userStakeInfo[msg.sender];
    require(_index <= stakes.length && _index < 8, "slot not available");
    require(stakes[_index].nftTokenId == 0, "already staked!");     // satisfied: inner call zeroed it
    nft.safeTransferFrom(msg.sender, address(this), _tokenid);
    stakes[_index].nftTokenId = _tokenid;
    stakes[_index].nblStakeAmount = 0;                              // ← does NOT restore the NBL amount
    ...
}

(NblNftStake.sol:1863-1879)

After the inner withdrawNft zeroes the slot, the attacker calls depositNft to put the NFT back into the slot so the outer withdrawNft continues without reverting. Note depositNft sets nblStakeAmount = 0 — it cannot restore the NBL — yet the outer call still pays out the cached amount it read before re-entry. That is where the duplication is realized.

Root cause#

withdrawNft violates the Checks-Effects-Interactions pattern. The harmful sequence is:

1. It caches amount = stakes[_index].nblStakeAmount into a local (step ①).
2. It makes an external call — nft.safeTransferFrom — which calls the attacker's onERC721Received before the payout and before the slot is cleared (step ②).
3. The slot's nblStakeAmount is only zeroed at the very end (step ④).

So during the reentrant window the slot still reports the full deposit, and the inner withdrawNft pays it out. When control returns, the outer call pays out the same deposit again from its cached local. One deposit, two payouts.

Two design decisions compose into the bug:

1. safeTransferFrom is an attacker-controlled callback, executed first. ERC-721's safeTransferFrom invokes onERC721Received on a contract recipient. Putting it before the effects turns a normal "return your NFT" step into a reentrancy entry point.
2. The inherited reentrancy guard is never applied. A single nonReentrant on withdrawNft (or on all three of depositNft/depositNbl/withdrawNft) would have made the re-entry revert with "ReentrancyGuard: reentrant call".

The doubled NBL is paid out of the stake contract's pooled NBL balance — i.e., other users' staked funds — so the loss is socialized across the protocol.

Preconditions#

• The stake contract holds enough NBL to satisfy a second withdrawal of the attacker's deposit. Here it held exactly 1,773,100,000 NBL, all of which the attacker borrowed and re-deposited, guaranteeing the duplicate withdrawal would clear.
• The attacker can deposit an NFT into a slot. The PoC simply moves NFT id 737 (grade 1) from the main attack contract into the helper (NBLGAME_exp.sol:81-83).
• Working capital in NBL to fund depositNbl. This is fully flash-loanable: the contract's whole NBL balance is borrowed from the NBL/USDT V3 pool and repaid in the same transaction (NBLGAME_exp.sol:85).
• No nonReentrant guard on withdrawNft (true — see above).

Attack walkthrough (with on-chain numbers from the trace)#

All figures are taken directly from output.txt. NBL has 18 decimals; the 1,773,100,000 NBL principal appears as 1.7731e27 wei.

The two equal NBL::transfer(... attacker, 1.7731e27) events at out:214-215 (inner) and out:287-288 (outer) are the smoking gun: one deposit, two identical payouts.

Why the re-entry doesn't revert#

The outer withdrawNft is mid-execution when the inner call zeroes slot 0. If the attacker did nothing, the outer call's later state writes (zeroing an already-zero slot) are harmless, but the re-deposit in step 8 is what keeps the slot consistent — the inner call left nftTokenId = 0, and depositNft (step 8) repopulates it. The decisive flaw is purely the cached amount local: even though the slot is zeroed by the inner call, the outer call no longer reads the slot for the NBL payout — it uses the value it captured before re-entry, so it pays the duplicate.

Profit / loss accounting#

The net NBL kept (1,767,780,700) equals the stake contract's entire NBL balance minus the 0.3% flash fee — confirming the attacker walked off with the contract's whole NBL treasury, financed entirely by the flash loan. PoC end-state: USDT 164967.658585, WETH 6.900257340231423430 (out:387-396).

Diagrams#

Sequence of the attack#

Stake-slot state through the reentrancy#

The CEI violation inside withdrawNft#

Remediation#

1. Apply the reentrancy guard. NblNftStake already inherits ReentrancyGuard. Add nonReentrant to withdrawNft, depositNft, depositNbl, and emergencyWithdraw. This alone makes the inner withdrawNft revert with "ReentrancyGuard: reentrant call".
2. Follow Checks-Effects-Interactions. Zero the slot's state before any external transfer: read amount/tokenid, set stakes[_index].nftTokenId = 0; nblStakeAmount = 0; inscriptionId = 0; begin = 0; and call stakebook.withdraw(...), and only then perform the NFT/NBL transfers. With the slot zeroed first, a re-entrant withdrawNft hits require(tokenid > 0, "no stake available") and reverts.
3. Avoid attacker-controlled callbacks where possible. If the slot does not need to support contract recipients, use a plain transferFrom (no onERC721Received hook) for the NFT return, or perform the NFT transfer last, after all accounting and token payouts.
4. Validate accounting against actual holdings. Track a global totalStakedNbl and assert that payouts never exceed it, so a duplicate withdrawal is caught even if a new reentrancy vector appears.

Any one of (1) or (2) fully closes this specific bug; both together is the robust fix.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo has several unrelated PoCs that fail to compile under forge test's whole-project build):

_shared/run_poc.sh 2024-01-NBLGAME_exp -vvvvv

• RPC: an Optimism archive endpoint is required (fork block 115293068). The project's foundry.toml maps the optimism fork alias to such an endpoint; most pruned public RPCs will fail with header not found / missing trie node at this historical block.
• Result: [PASS] testExploit().

Expected tail (output.txt):

Ran 1 test for test/NBLGAME_exp.sol:ContractTest
[PASS] testExploit() (gas: 1039492)
Logs:
  Exploiter USDT balance before attack: 0.000000
  Exploiter WETH balance before attack: 0.000000000000000000
  Exploiter USDT balance after attack: 164967.658585
  Exploiter WETH balance after attack: 6.900257340231423430

Suite result: ok. 1 passed; 0 failed; 0 skipped

References: SlowMist — https://twitter.com/SlowMist_Team/status/1750526097106915453 · Ancilia — https://twitter.com/AnciliaInc/status/1750558426382635036 · BlockSec Explorer tx 0xf4fc3b638f1a377cf22b729199a9aeb27fc62fe2983a65c4d14b99ee5c5b2328 (Optimism, NBLGAME, ~$180K).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2024-01-NBLGAME_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: NBLGAME_exp.sol.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "NBLGAME (NblNftStake) Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.