# Malicious Creator can steal from collectors upon minting with a custom NFT contract

Malicious creator's custom NFT contract implements mintCountTo to mint fewer NFTs than paid for, letting collectors lose funds on fixed-price sales.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: joestakey
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-08-foundation#m-06
- Library page: http://bugbountylibrary.com/r/c4%3A2022-08-foundation%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** NFTDropMarketFixedPriceSale.mintFromFixedPriceSale / INFTDropCollectionMint.mintCountTo
**Root cause:** The marketplace trusts the creator-supplied nftContract's mintCountTo() to mint exactly `count` NFTs, with no post-mint balance verification.
**Steps:**
1. Creator deploys a malicious nftContract whose mintCountTo mints only one NFT per call regardless of `count`.
2. Creator calls `NFTDropMarketFixedPriceSale.createFixedPriceSale()` for nftContract with limit 15.
3. Bob sees `CreateFixedPriceSale(customERC721, Alice, price, limit)` and calls `mintFromFixedPriceSale(customERC721, count == 10)`.
4. Bob pays for 10 NFTs but mintCountTo mints only one, so he receives 1 NFT.
**How found:** Reasoned about the trust boundary: the marketplace delegates minting to a creator-controlled contract implementing INFTDropCollectionMint, so a malicious mintCountTo can under-deliver.
**Exploitation:** Creator lists a fixed-price sale backed by a malicious INFTDropCollectionMint contract; collectors pay full price for `count` NFTs but the contract mints fewer (or none), and the creator keeps the payment.
**Insight:** When a marketplace calls a creator-supplied mint hook, verify delivered balance (balanceOf before/after) rather than trusting the hook's return; the same gap exists wherever user-supplied contracts fulfill paid orders.