# Lack of sanity check on _initialTokenSupply and _initialTokenPrice can lead to a seller losing his NFT

Missing sanity check on initial token supply/price lets primaryReserveBalance round to zero, bricking buy/sell and forcing a buyout gas war that can cost the seller their NFT.

- Payout: Audit contest
- Severity: medium
- Program: Nibbl
- Found by: itsmeSTYJ
- Disclosed: 2022-08-01
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-06-nibbl#m-05
- Library page: http://bugbountylibrary.com/r/c4%3A2022-06-nibbl%3AM-05
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NibblVault.sol bonding-curve vault initialization
**Root cause:** No check that primaryReserveRatio * _initialTokenSupply * _initialTokenPrice >= SCALE * 1e18, so integer division rounds _primaryReserveBalance and fictitiousPrimaryReserveBalance to 0.
**Steps:**
1. Create vault with small _initialTokenSupply * _initialTokenPrice such that primaryReserveRatio * supply * price < SCALE * 1e18 (e.g. price 1 wei, supply < 5e18).
2. Observe _primaryReserveBalance and fictitiousPrimaryReserveBalance computed as 0.
3. Call buy: `_chargeFee` reverts (line 222) because reserve is zero.
4. Call sell: fails since totalSupply == initialSupply.
5. Only recovery is owner calling `initiateBuyout`; race against others after minBuyoutTime.
**How found:** Code review of vault initialization math; noticed division rounding to zero and traced downstream effects on buy/sell and buyout paths.
**Exploitation:** Attacker monitors for misconfigured vaults, waits for minBuyoutTime, and races the owner's initiateBuyout in a gas war to seize the NFT; owner loses NFT if they lose the race.
**Escalation:** Combined with missing _minBuyoutTime sanity check, seller can lose NFT immediately after vault creation.
**Insight:** When auditing bonding-curve vaults, check that reserve/curve parameters cannot round to zero via integer division; a zero reserve silently bricks trading and leaves buyout as the only exit, creating a race.