# Sale contracts can be bricked if any other minter mints a token with an id that overlaps the sale

Escher sale contracts mint sequential token IDs; if any other minter mints an overlapping ID, buy() reverts permanently, bricking the sale and locking funds.

- Payout: Contest reward
- Severity: medium
- Program: Escher
- Credited: adriro
- Disclosed: 2023-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-escher-findings/issues/390
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-escher%3AM-10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** FixedPrice/OpenEdition/LPDA sale contracts (Solidity)
**Root cause:** Sale contracts mint sequential IDs starting at a configurable currentId without reserving the range; OZ ERC721 _mint reverts if the token ID already exists, and sale IDs cannot be updated mid-sale.
**Steps:**
1. Create Escher721 NFT and a FixedPrice sale with currentId=10, finalId=15.
2. Grant MINTER_ROLE to the sale contract and to another minter address.
3. Other minter calls `nft.mint(receiver, 12)` (an ID inside the sale range).
4. Buyer calls `fixedSale.buy{value: price*amount}(amount)`; loop `nft.mint(msg.sender, x)` for x=11..15 reverts with 'ERC721: token already minted'.
5. Sale is permanently bricked; FixedPrice/LPDA funds cannot be withdrawn since all IDs must sell.
**How found:** Code reading of the buy() mint loop combined with OZ ERC721 _mint's `require(!_exists(tokenId))`, noticing the sale assumes exclusive ownership of its ID range without enforcing it.
**Exploitation:** Any holder of MINTER_ROLE (creator, another sale contract, or overlapping sale) mints a token whose ID falls within an active sale's range, causing every subsequent buy() to revert and locking proceeds in FixedPrice/LPDA.
**Insight:** When a contract mints sequential IDs from a configurable start, check whether the ID range is actually reserved/enforced; any other MINTER_ROLE holder or overlapping sale can collide and permanently DoS the mint loop.