Submitted by bin2chen, also found by oakcobalt
When isolateLiquidate(supplyAsCollateral=false) is executed, finally erc721DecreaseIsolateSupplyOnLiquidate() will be executed and the NFT will be transferred to the user.
We know from the above code that this method does not clear the tokenData.lockerAddr, so now tokenData is:
User Alice has NFT_1; then Alice executes BVault.depositERC721(NFT_1, supplyMode = SUPPLY_MODE_CROSS) will succeed, deposit() does not check lockerAddr.
So tokenData becomes:
After that the users NFT_ 1 will be locked because withdrawERC721() -> validateWithdrawERC721() will check that lockerAddr must be address(0):
Other Isolate methods cannot be operated either.
Note: erc721DecreaseIsolateSupply() is similar.
Unable to retrieve NFT.
Context
thorseldon (BendDAO) confirmed and commented:
0xTheC0der (judge) commented:
