# Deactivated tiers can still mint reserve tokens, even if no non-reserve tokens were minted. 

Deactivated Juicebox NFT tiers still allow minting the first reserve token via rounding logic, letting the reserve beneficiary mint an NFT and redeem funds.

- Payout: Contest reward
- Severity: medium
- Program: Juicebox
- Credited: Trust
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-juicebox-findings/issues/189
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-juicebox%3AM-07
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** JB721 NFT tier reserve minting (recordMintReservesFor / _numberOfReservedTokensOutstandingFor)
**Root cause:** The rounding branch returns 1 outstanding reserve token when initialQuantity == remainingQuantity, without checking whether the tier was deactivated; a deactivated tier with no prior minting still qualifies.
**Steps:**
1. Deploy/configure a tier with a nonzero reservedRate.
2. Deactivate the tier via `adjustTiers()` before any non-reserve token is minted (initialQuantity == remainingQuantity).
3. Call `recordMintReservesFor(_tierId, 1)` as the reserve beneficiary.
4. `_numberOfReservedTokensOutstandingFor` returns 1 due to the rounding branch, so the mint succeeds and a token is generated.
**How found:** Code reading of `_numberOfReservedTokensOutstandingFor`: noticed the rounding branch (initialQuantity == remainingQuantity returns 1) does not account for tier deactivation, where no future minting will occur.
**Exploitation:** Reserve beneficiary mints a reserve NFT for a deactivated tier that never had tokens minted, then uses the redemption mechanism to withdraw funds backing that NFT.
**Insight:** When a rounding/round-up branch exists to bootstrap the first reserve mint, check it against lifecycle states like deactivation/removal where the assumption 'more mints will follow' no longer holds.