# Possible to bypass saleConfig.limitPerAccount

Foundation NFT drop's per-account mint limit is enforced via balanceOf, so a buyer can mint, transfer NFTs out, and repeat to exceed the limit.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: itsmeSTYJ
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-08-foundation#m-04
- Library page: http://bugbountylibrary.com/r/c4%3A2022-08-foundation%3AM-04
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** FixedPriceDrop NFT marketplace sale limit
**Root cause:** The per-account purchase limit is derived from the buyer's current NFT balance rather than a persistent counter of NFTs purchased, so moving tokens off the address resets the allowance.
**Steps:**
1. Create a fixed price sale with `limitPerAccount = 3`.
2. Call `nftDropMarket.mintFromFixedPriceSale{value: price*3}(collection, 3, payable(0))`.
3. Confirm `getAvailableCountFromFixedPriceSale(collection, collector)` returns 0.
4. Transfer the 3 NFTs out via `nftDropCollection.transferFrom(collector, address(5), id)`.
5. Call `mintFromFixedPriceSale` again for 3 more NFTs, exceeding the limit.
**How found:** Reading the limit enforcement logic and noticing it relies on balanceOf, then testing whether transferring NFTs out restores the available count.
**Exploitation:** A single smart contract repeatedly mints the max allowed, transfers the NFTs to another address, and mints again, buying out an entire limited drop in one transaction flow.
**Insight:** When a purchase cap is computed from a live token balance, check whether transferring or staking tokens out resets the allowance; a persistent per-address purchase counter is needed.