# MinterContract::payArtist can result in double the intended payout

payArtist validates team splits against the artist/team allocation but pays artists using stale proposed address percentages, allowing up to double royalty payout.

- Payout: Contest reward
- Severity: medium
- Program: NextGen
- Credited: immeas
- Disclosed: 2024-01-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-10-nextgen-findings/issues/1686
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-nextgen%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MinterContract.payArtist royalty distribution
**Root cause:** payArtist checks _teamperc1+_teamperc2 against collectionRoyaltiesPrimarySplits.artistPercentage, but computes artist payouts from collectionArtistPrimaryAddresses percentages that were accepted under a prior split configuration.
**Steps:**
1. Admin calls `setPrimaryAndSecondarySplits(colId, 100, 0, 100, 0)` (100% artist).
2. Artist calls `proposePrimaryAddressesAndPercentages(colId, artist, 0, 0, 100, 0, 0)` and `acceptAddressesAndPercentages(colId, true, true)`.
3. Admin calls `setPrimaryAndSecondarySplits(colId, 0, 100, 0, 100)` (0% artist, 100% team).
4. Admin calls `payArtist(colId, team, 0, 100, 0)`; require passes since artistPercentage==0.
5. Artist still receives 100% via add1Percentage, team receives 100% -> 2x payout.
**How found:** Code reading of the split validation flow: noticed payArtist's require uses collectionRoyaltiesPrimarySplits.artistPercentage while payout math uses collectionArtistPrimaryAddresses percentages, which are not re-validated after a split change.
**Exploitation:** Admin (or function-level admin) updates splits after artist percentages were accepted; payArtist pays both the full team share and the stale full artist share, draining funds held for other collections in the shared contract.
**Escalation:** Overpayment taps into other collections' royalties since all funds sit in one contract; artist paid before team.
**Insight:** When a contract stores two related percentage sets (global allocation vs per-address distribution), check every payout path re-validates that the distribution still sums to the current allocation rather than a stale accepted value.