# distribute DoS on missing receiveRewards implementation

NFTX distribute reverts when a feeReceiver returns empty data, letting one malicious receiver DoS all fee distribution.

- Payout: Audit contest
- Severity: high
- Program: NFTX
- Disclosed: 2021-06-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-nftx-findings/issues/46
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-nftx%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:dos

**Target:** NFTXEligibilityManager._sendForReceiver / distribute
**Root cause:** _sendForReceiver abi.decode's the receiver's return data without checking returnData.length == 1; a receiver returning no data makes decode revert, reverting the whole distribute call.
**Steps:**
1. Call distribute, which iterates feeReceivers and calls _sendForReceiver on each.
2. A feeReceiver implements receiveRewards but returns no data (empty returnData).
3. abi.decode(returnData, (bool)) reverts on empty bytes.
4. The revert propagates, reverting the entire distribute transaction for all receivers.
**How found:** Code review of _sendForReceiver's decode of receiver return data without a length check.
**Exploitation:** A single malicious or poorly implemented feeReceiver returns empty data from receiveRewards, causing abi.decode to revert and blocking all other users from receiving their fees.
**Insight:** When decoding arbitrary external callee return data, check returnData.length before abi.decode; any single reverting/malformed receiver in a loop can DoS the whole batch.