Submitted by hash, also found by piyushshukla and ladboy233 (1, 2)
Users can flash steal NFTs circumventing any restrictions imposed on the NFT
When stopping a rental,the rented asset (ERC721/ERC1155) is transferred before the actual existance of the order is checked.
https://github.com/re-nft/smart-contracts/blob/3ddd32455a849c3c6dc3c3aad7a33a6c9b44c291/src/policies/Stop.sol#L293-L302
Since ERC721/ERC1155 transfers invoke the onReceived functions in case of a contract receiver, it allows an attacker to create a rental order after stopping it first. This gives the attacker unrestricted access to the rented NFT.
https://gist.github.com/10xhash/a6eb9552314900483a1cffe91243a169
Check for the order existance initially itself in the stopRent function
0xean (Judge) commented:
Alec1017 (reNFT) confirmed, but disagreed with severity and commented:
0xean (Judge) decreased severity to Medium
reNFT mitigated:
Status: Mitigation confirmed. Full details in reports from juancito, EV_om and sin1st3r__.
