# CoreCollection's token transfer can be disabled

Attacker keeps RoyaltyVault balance at 1 wei so platformShare rounds to zero, making zero-reverting ERC20 transfers fail and blocking all CoreCollection transfers.

- Payout: Audit contest
- Severity: medium
- Program: Joyn
- Found by: hyh
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-joyn-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-joyn%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** CoreCollection ERC721 _beforeTokenTransfer / RoyaltyVault.sendToSplitter
**Root cause:** sendToSplitter computes platformShare = balance*platformFee/10000 from live vault balance; with balance=1 wei it rounds to 0, and the required transfer of 0 to platformFeeRecipient reverts for ERC20s that reject zero-value transfers, failing the whole token transfer.
**Steps:**
1. Attacker bot watches royaltyVault for positive royaltyAsset balance
2. Call `sendToSplitter()` to drain vault to exactly zero (splitterShare = balance - platformShare leaves no dust)
3. Send `1 wei` royaltyAsset to royaltyVault
4. Any CoreCollection token transfer now triggers `_beforeTokenTransfer` -> `sendToSplitter()`; `platformShare = (1 * platformFee)/10000 = 0`
5. `IERC20(royaltyAsset).transfer(platformFeeRecipient, 0)` reverts on zero-reverting tokens, reverting the transfer
6. Repeat lazily (no front-run needed) to keep vault at 1 wei
**How found:** Code reading of _beforeTokenTransfer calling sendToSplitter on positive balance, combined with integer division rounding and knowledge of weird ERC20s that revert on zero-value transfers; noted sendToSplitter leaves exactly zero dust, opening the balance to tiny-amount manipulation.
**Exploitation:** Griefing: no capital beyond 1 wei; attacker repeatedly empties vault then seeds 1 wei so every subsequent NFT transfer reverts, rendering CoreCollection inoperable until manual intervention/redeploy.
**Escalation:** Also works for any royaltyAsset if platformFee=100%: platformShare=1 wei, splitterShare=0, violating Splitter.incrementWindow's positive royaltyAmount require.
**Insight:** When a transfer hook requires an on-the-spot fee split computed from live balance, integer division can round a share to zero; check whether the token reverts on zero-value transfers and whether the split leaves dust, since a 1-wei seed can brick every transfer.