# NFT Owner can stuck Crowdfund user funds

NFT owner can gift worthless NFT to AuctionCrowdfund with zero bids, forcing contributors to pay max price instead of refund.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: csanuragjain
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/197
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** AuctionCrowdfund.sol finalize function
**Root cause:** finalize sets lastBid_ = totalContributions when NFT is gifted and lastBid_ == 0, so contributors pay full amount despite no bid.
**Steps:**
1. Create AuctionCrowdfund for NFT N; users contribute 100.
2. No bids placed; lastBid_ remains 0.
3. NFT owner transfers NFT to contract via safeTransferFrom.
4. Call finalize(); condition nftContract.safeOwnerOf(nftTokenId) == address(this) and lastBid_ == 0 triggers lastBid_ = totalContributions (100).
5. Party created with lastBid_=100; funds not refunded.
**How found:** Code review of finalize logic: noticed lastBid_ set to totalContributions when NFT gifted with zero bids, enabling forced purchase.
**Exploitation:** NFT owner gifts worthless NFT to crowdfund contract after contributions but before finalize, forcing contributors to pay totalContributions instead of receiving refund.
**Insight:** In crowdfund/auction contracts, check if gifted NFTs bypass bid validation and force max payment; test zero-bid scenarios with gifted assets.