# GolomTrader's _settleBalances double counts protocol fee, reducing taker's payout for a NFT sold

GolomTrader._settleBalances multiplies the protocol fee by amount twice, so takers selling multiple NFTs receive less than due, leaving funds stuck in the contract.

- Payout: Contest reward
- Severity: high
- Program: Golom
- Credited: hyh
- Disclosed: 2023-04-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-golom-findings/issues/240
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GolomTrader.sol _settleBalances (fillBid/fillCriteriaBid payout logic)
**Root cause:** protocolfee is computed as ((o.totalAmt*50)/10000)*amount, then subtracted inside a term that is itself multiplied by amount, so the fee is deducted amount times instead of once.
**Steps:**
1. Call fillBid/fillCriteriaBid with amount > 1 (e.g. amount=6).
2. Observe protocolfee = ((o.totalAmt*50)/10000)*amount.
3. Taker payout = (o.totalAmt - protocolfee - ...) * amount - p.paymentAmt, subtracting protocolfee*amount.
4. With base fee 1 ETH and amount=6, 36 ETH is deducted instead of 6 ETH; 30 ETH remains on contract balance.
**How found:** Code review of _settleBalances payout arithmetic, noticing protocolfee already includes amount but is subtracted inside a term multiplied by amount again.
**Exploitation:** Any taker filling a bid with amount>1 receives less than owed; the excess stays on GolomTrader's balance, unaccounted and stealable by an attacker tracking contract state (or permanently frozen once other bugs are fixed).
**Insight:** When a fee variable is pre-multiplied by a quantity, check every downstream use for a second multiplication by the same quantity; batch/multi-amount paths are where these double-counts hide.