#  Users can avoid paying fees while trading trustlessly & using Golom's network effects

Maker sets totalAmt to 0 and hides real price in order.root, so a reserved-address contract fills the order paying the maker directly while Golom collects zero fees.

- Payout: Contest reward
- Severity: high
- Program: Golom
- Credited: kankodu
- Disclosed: 2023-04-05
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-07-golom-findings/issues/33
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-golom%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** GolomTrader.fillAsk order settlement contract
**Root cause:** Fee calculation derives from order.totalAmt, which the maker controls and can set to 0; the contract never checks that totalAmt covers the actual paymentAmt transferred to the maker.
**Steps:**
1. Deploy `AvoidsFeesContract` holding a reference to GolomTrader.
2. Maker signs an order with `totalAmt=0`, `exchange.paymentAmt=0`, `prePayment.paymentAmt=0`, `reservedAddress=AvoidsFeesContract`, and the true price encoded in `order.root`.
3. Taker calls `AvoidsFeesContract.fillAsk(order, 1, 0x0, {paymentAmt: truePrice, paymentAddress: maker}, receiver)` with `msg.value=truePrice`.
4. Contract requires `o.reservedAddress==address(this)` and `p.paymentAmt==uint256(o.root)`, then forwards to `golomTrader.fillAsk`.
5. Maker receives full price; exchange/royalty fees computed from totalAmt=0 are zero.
**How found:** Reading GolomTrader fee logic, noticed fees are computed from order.totalAmt which is maker-supplied and unconstrained relative to paymentAmt; realized reservedAddress lets a maker gate execution to a wrapper that enforces the real price out-of-band.
**Exploitation:** Maker lists NFT with totalAmt=0 so frontend computes zero exchange and royalty amounts, reserves a custom contract as reservedAddress, and encodes the desired price in root. Taker pays the maker directly through the wrapper; Golom's fee logic sees totalAmt=0 and collects nothing while the trade still settles on-chain.
**Insight:** When fees are computed from a maker-supplied order field, check whether that field is independently validated against the actual value transferred; reservedAddress-style hooks let makers move the real price into unchecked fields like root or deadline.