EnjinCryptoItems exploit analysis

Every Enjin item is fronted by a per-item ERC-1155 adapter clone. A clone has no logic of its own: for any selector it looks up delegates(selector) on its "contract registry" and delegatecalls whatever implementation address is stored there. The two live registries expose an unprotected initialize(uint256) with no access control. Any address can call it.

The two registries are at 0x13fA4b9a6C2F2604C919f96F456e3b50E968b157 and 0x268C039A3127D3107c014F0DC6c390A53e6dB27f, both with original manager 0x1952e45D5bD519DC679Cc459C5fD0Ba46305880c. The attacker contract called registry.initialize(1) then registry.acceptManager(), after which ManagerUpdate fired from the original manager to the attack contract: the attacker became the registry manager purely by re-running the open initializer.

As registry manager, the attacker called updateContract(impl, "stealNFT(address,address,uint256);", ...) plus the transferFrom variant, registering its own code as the body those clones delegatecall into. The registered body moved item ownership through the platform's internal transfer functions (0x41c1df0e for non-fungibles, 0xf95d7da3 for fungibles) with no owner-approval check, so it pulled items out of arbitrary holders. Each stolen item was then melt()-ed for its ENJ backing out of the reserve at 0x4E643a25a64952895f553f20252861258727174e, with melt paying msg.sender.

The attacker (EOA 0x5ec1ba7892d11059c39557b762a97dd695778ca5, via attack contract 0x7083DdecE38216C7741fa76c75326Bea744ED321) carried out the drain in a single transaction on block 25834071 of Ethereum (0xd4a382da03c99ce3084661b913b50b525a4b283f66f510bcf1040152830b2a7e), pulling 54 items from the same holders and melting them for ~5,231,353 ENJ, or about $142K.

The fix is to gate initialize(uint256) on the registry manager role, so that becoming manager requires going through whatever off-chain onboarding the protocol actually intended. A simpler, narrower fix is to require a non-zero caller-supplied nonce or a manager-signed message before acceptManager() will fire ManagerUpdate.