# MarketFees: Seller referrer fee can underflow

In Foundation's MarketFees, seller referrer fee can exceed seller revenue when protocol fee plus creator royalty is high, underflowing and reverting valid sales.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Disclosed: 2022-12-14
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-11-foundation#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-foundation%3AM-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** MarketFees._getFees in NFT marketplace contracts
**Root cause:** sellerReferrerTakeRateInBasisPoints can be up to 50% while only protocol fee + creator royalty < 100% is enforced, so sellerRev (or creatorRev on primary sales) can be smaller than the computed sellerReferrerFee, causing an arithmetic underflow.
**Steps:**
1. Configure protocol fee 20% and creator royalty 35%, leaving sellerRev at 45% of price.
2. Set exhibition take rate (sellerReferrerTakeRateInBasisPoints) above 45% (allowed up to 5000 bps).
3. Trigger a sale so `sellerReferrerFee = (price * sellerReferrerTakeRateInBasisPoints) / BASIS_POINTS` exceeds sellerRev.
4. `sellerRev -= sellerReferrerFee` underflows and the transaction reverts, blocking the sale.
**How found:** Read the fee validation logic and noticed the invariant only bounds protocol fee + creator royalty below 100%, while the seller referrer take rate is independently allowed up to 50%, leaving a gap where the subtraction underflows.
**Insight:** When two independent basis-point parameters are each bounded separately, check whether their sum can exceed the residual revenue bucket they are subtracted from; the missing invariant is the cross-parameter bound.