# GroupBuy: Lost ETH when the NFT is bought for less than the minimum reserve price

GroupBuy purchase allows NFT bought below min reserve price, but claim still deducts full reserve per quantity, trapping contributor ETH.

- Payout: Contest reward
- Severity: high
- Program: Tessera
- Credited: Lambda
- Disclosed: 2023-04-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-tessera-findings/issues/7
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-tessera%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GroupBuy purchase/claim settlement logic (Solidity contract)
**Root cause:** purchase only reverts if _price exceeds minReservePrices*filledQuantities, allowing cheaper purchase; claim still subtracts quantity*reservePrice from contribution, so unused funds are not refunded.
**Steps:**
1. Set filledQuantities[_poolId]=100, minReservePrices[_poolId]=1 ETH.
2. Purchase NFT for 50 ETH (passes since 50 <= 100).
3. Contributor with 20 ETH contribution calls claim; contribution -= 20*1 ETH => 0 refunded though only 10 ETH was used.
4. Total 50 ETH of contributor funds lost.
**How found:** Code reading: noticed purchase permits price below minReservePrices*filledQuantities while claim assumes full reserve price was paid, creating accounting mismatch.
**Exploitation:** Attacker/operator buys the NFT at a discount below the reserve total; claim logic deducts full reserve per quantity, so excess contributor ETH remains stuck/lost rather than refunded.
**Insight:** When a purchase price is bounded only from above, check every downstream settlement path that assumes the bound was hit exactly; mismatched assumptions between buy and refund logic leak user funds.