# Charged Particles Griefing Bugfix Review

Proton creator set a reverting ransom contract as royalties receiver, locking the NFT so it could only be sold after paying a 1 ETH bribe.

- Payout: $5,000
- Severity: high
- Program: Charged Particles
- Credited: Alejandro Muñoz-McDonald
- Disclosed: 2021-05-21
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/charged-particles-griefing-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-charged-particles-griefing-bugfix-review
- Tags: domain:web3 impact:dos impact:funds-loss kind:bounty platform:blog platform:immunefi sev:high tech:evm tech:solidity vuln:business-logic vuln:dos

**Target:** Proton.sol ERC721 royalty receiver logic
**Root cause:** setCreatorRoyaltiesReceiver accepted an arbitrary contract address as royalties receiver; the sale path pays royalties via a call that reverts if the receiver's fallback reverts, so a malicious receiver permanently blocks transfers.
**Steps:**
1. Call `createProtonForSale` with valid params and `royaltiesPercent > 0`; wait for the token to be sold.
2. Deploy a `Ransom` contract whose `fallback()` does `require(!ransomEnabled)` and whose `unlockNFT()` clears the flag only when `msg.value >= 1 ether`.
3. Call `setCreatorRoyaltiesReceiver(energizedParticleId, ransomAddress)`.
4. Any subsequent sale attempt pays royalties to the ransom contract, whose fallback reverts, locking the Proton until 1 ETH is paid.
**Exploitation:** Attacker sells a Proton, then points the royalties receiver at a contract that reverts on any incoming payment unless a 1 ETH ransom is paid, denying the buyer the ability to resell and extorting a bribe.
**Insight:** In NFT marketplaces, royalty/fee receivers are attacker-controlled addresses invoked during transfer; check whether a reverting or gas-guzzling receiver can brick the sale path, and whether the receiver can be changed post-sale.