# A vault owner can also be the controller and arbitraily set the secondary market royalties

Vault owner who is also FERC1155 controller can frontrun secondary sales by setting uncapped royalties to 100%, stealing the full sale payment.

- Payout: Contest reward
- Severity: medium
- Program: Fractional
- Credited: 0xNineDec
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/166
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** FERC1155 royalty setter / VaultRegistry.createCollectionFor
**Root cause:** VaultRegistry.createCollectionFor lets a user deploy a vault where they are also the FERC1155 controller, and setRoyalties has no cap or timelock, so the controller can arbitrarily raise royalties.
**Steps:**
1. Alice calls `VaultRegistry.createCollectionFor(merkleRoot, alice, ...)` directly, bypassing `BaseVault.deployVault()`, making her the FERC1155 controller.
2. Alice mints fTokens via Minter module and distributes them; sets royalties to 1% via `setRoyalties(id, alice, 1)`.
3. Alice watches mempool for a large secondary sale by Bob.
4. Alice frontruns with `setRoyalties(id, alice, 100)`.
5. Bob's sale executes; `royaltyInfo` returns 100% to Alice, Bob receives nothing.
6. Alice backruns with `setRoyalties(id, alice, 1)` to restore state.
**How found:** Noticed two vault deployment paths with different privilege outcomes: BaseVault.deployVault uses protocol-controlled fNFT, while VaultRegistry.createCollectionFor lets the caller be controller; combined with uncapped setRoyalties this enables frontrunning.
**Exploitation:** Attacker deploys vault via createCollectionFor to become controller, builds secondary market momentum, then frontruns a large transfer by setting royalties to 100% and backruns to restore, capturing the entire sale payment.
**Insight:** When a protocol exposes two deployment entrypoints with different privilege outcomes, check whether the less-guarded one grants the caller control over fee/royalty parameters that affect other users' transactions.