# NFT creator sales revenue recipients can steal gas

Foundation's MarketFees forwards 210k gas to each of up to 5 NFT creator recipients, letting malicious creators burn ~1.05M gas per sale at buyers' expense.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: berndartmueller
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-08-foundation#m-02
- Library page: http://bugbountylibrary.com/r/c4%3A2022-08-foundation%3AM-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** NFTDropMarketFixedPriceSale / MarketFees._distributeFunds revenue distribution
**Root cause:** _distributeFunds forwards SEND_VALUE_GAS_LIMIT_MULTIPLE_RECIPIENTS (210,000) to every creator recipient in a loop of up to MAX_ROYALTY_RECIPIENTS=5, instead of only the first, so malicious creator contracts can consume the full forwarded gas on each sale.
**Steps:**
1. Sell an NFT via `NFTDropMarketFixedPriceSale.mintFromFixedPriceSale`, triggering `MarketFees._distributeFunds`.
2. Observe the creator loop calls `_sendValueWithFallbackWithdraw(creatorRecipients[i], creatorShares[i], SEND_VALUE_GAS_LIMIT_MULTIPLE_RECIPIENTS)` with 210,000 gas per recipient.
3. Register up to 5 creator recipient contracts that consume the full forwarded gas on receive.
4. Each sale then costs the buyer up to `5 * 210_000 = 1_050_000` extra gas (e.g. ~0.028 ETH at 20 gwei).
**How found:** Code review of the revenue distribution loop in MarketFees._distributeFunds, noticing the asymmetric gas limits (210k for creators vs 20k for seller/protocol/referrer) and multiplying by MAX_ROYALTY_RECIPIENTS to bound worst-case buyer cost.
**Exploitation:** Malicious or compromised creator recipient contracts burn the full 210k gas forwarded to each of up to 5 recipients on every sale, inflating the buyer's gas cost and griefing sales; no direct fund theft, only gas cost shifted to buyers.
**Insight:** When auditing payout loops, multiply the per-recipient forwarded gas cap by the max recipient count; any loop forwarding a high gas stipend to attacker-controlled addresses is a griefing vector paid for by the caller.