# Founders can receive less tokens that expected

Founder token ID assignment in Nouns Builder skips modulo, so some founder IDs exceed 99 and are never minted, under-allocating founders.

- Payout: Contest reward
- Severity: medium
- Program: Nouns Builder
- Credited: MEP
- Disclosed: 2022-11-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-nouns-builder-findings/issues/269
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-04
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Token.sol founder token allocation mapping
**Root cause:** When filling tokenRecipient mapping, baseTokenId is incremented by schedule without applying % 100, so IDs can exceed 99 and never match tokenId % 100.
**Steps:**
1. Deploy with founders Alice 10% and Bob 11% via deployWithCustomFounders
2. Mint 100 - totalOwnership tokens via token.mint() pranked as auction
3. Observe Bob's schedule yields IDs 1,11,...,91,100; ID 100 unreachable
4. assertEq shows Bob receives fewer than 11 tokens
**How found:** Code reading of the founder schedule loop noticed baseTokenId could exceed 99 since modulo was omitted; verified with Foundry tests on 10%/11% split.
**Insight:** When a mapping is keyed by tokenId % N, verify every write path applies the same modulo; off-by-one in schedule increments silently drops allocations only for specific percentage pairs like (10,11) or (25,33).