# Locked funds are debited twice from the user during tokenization leading to fund loss

FairSide tokenizeConviction debits the user's FSD lock amount twice, so locking 100 tokens actually costs 200, causing fund loss.

- Payout: Audit contest
- Severity: high
- Program: FairSide
- Disclosed: 2021-07-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-fairside-findings/issues/29
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** ERC20ConvictionScore / FairSideConviction tokenization flow
**Root cause:** The locked FSD amount is transferred from the user in tokenizeConviction() (ERC20ConvictionScore.sol Line282) and again in FairSideConviction.createConvictionNFT() (Line50), debiting the user twice.
**Steps:**
1. User calls `tokenizeConviction(100)` specifying 100 FSD to lock.
2. 100 FSD transferred from user to FairSideConviction at ERC20ConvictionScore.sol Line282.
3. createConvictionNFT() transfers the same locked amount again at FairSideConviction.sol Line50.
4. User is debited 200 FSD total for a 100 FSD lock.
**How found:** Code review of the tokenization path tracing FSD transfers across tokenizeConviction() and createConvictionNFT(), spotting the redundant transfer.
**Insight:** When a flow spans two contracts, trace every token transfer of the same logical amount; a lock/escrow amount transferred in both the entry function and the NFT-minting callee double-charges users.