# Attacker can list an NFT they own and inflate to zero all users' contributions, keeping the NFT and all the money

BuyCrowdfund/CollectionBuyCrowdfund allow maximumPrice=0, letting an NFT lister flash-loan-contribute, buy their own NFT, and drain all contributions.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: Trust
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/213
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:governance

**Target:** BuyCrowdfund / CollectionBuyCrowdfund crowdfund contracts
**Root cause:** maximumPrice of zero is permitted, so the lister's own contribution can dominate voting power and equity; the system cannot detect that crowdfund creator and NFT owner are the same entity.
**Steps:**
1. Attacker lists own NFT with maximumPrice=0 on BuyCrowdfund/CollectionBuyCrowdfund.
2. Flash-loan ~10,000X and in callback: `contribute()` borrowed funds, call `buy()` to purchase the NFT, call lister's `sendProfit()` to recover sell amount, repay flash loan.
3. Attacker now holds >99.99% votes; create ArbitraryCallsProposal with `token.approve(ATTACKER, token_id)` (allowed in unanimous proposals).
4. Call NFT `transferFrom()` to reclaim the NFT, keeping contributions.
**How found:** Reasoned that when maximumPrice is zero, the lister's contribution returns to them while granting dominant voting power, unlike the fair-price case where contributors accept max-price risk.
**Exploitation:** Flash loan finances a massive contribution to a self-listed NFT with zero max price; buy() executes, sendProfit returns the sale proceeds to the attacker, loan repaid; attacker controls the party and approves the NFT back to themselves.
**Insight:** In crowdfund/auction designs, check whether a zero or unbounded max price lets the seller self-contribute to dominate share allocation; the seller and creator identity is unknowable on-chain, so cap or forbid zero max price.