# mintFromFixedPriceSale for a custom contract can lead to users losing funds

Foundation's mintFromFixedPriceSale trusts custom mintCountTo return value; a compliant contract returning 0 after sellout makes late minters pay ETH for no NFT.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: joestakey
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-08-foundation#m-08
- Library page: http://bugbountylibrary.com/r/c4%3A2022-08-foundation%3AM-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NFTDropMarketFixedPriceSale.mintFromFixedPriceSale / INFTDropCollectionMint.mintCountTo
**Root cause:** DropMarket assumes mintCountTo reverts once all tokens are minted, but the interface doesn't specify this; a compliant implementation returning 0 (or not reverting) lets the sale proceed and distribute funds without minting.
**Steps:**
1. Alice deploys custom ERC721 implementing INFTDropCollectionMint where mintCountTo returns 0 when all tokens minted.
2. Collectors call `mintFromFixedPriceSale` until supply exhausted.
3. Bob calls `mintFromFixedPriceSale`; `mintCountTo` returns 0 instead of reverting.
4. Function proceeds to distribute funds; Bob pays mintCost ETH and receives no NFT.
**How found:** Reading the INFTDropCollectionMint interface spec and noticing it doesn't mandate revert on sold-out; hypothesized a compliant implementation returning 0 and traced mintFromFixedPriceSale's fund distribution path.
**Exploitation:** Any late minter after sellout on a custom contract whose mintCountTo returns 0 instead of reverting loses the full mintCost with no NFT delivered; no attacker needed, loss occurs passively.
**Insight:** When a market trusts an external mint hook's return value, check whether the interface spec pins down failure semantics (revert vs sentinel return); a spec-compliant non-reverting implementation can silently drain payer funds.