# Incorrect amounts of ETH are transferred to the DAO treasury in ERC20TokenEmitter::buyToken(), causing a value leak in every transaction

ERC20TokenEmitter.buyToken sends only the buyer's ETH share to the DAO treasury, leaving the creators' token-purchase ETH stuck in the contract on every purchase.

- Payout: Contest reward
- Severity: high
- Program: Collective
- Credited: osmanozdemir1
- Disclosed: 2024-02-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-revolutionprotocol-findings/issues/210
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC20TokenEmitter.buyToken() payable function
**Root cause:** The treasury transfer only sends toPayTreasury (buyer share); the creator share minus direct payment, which is used to mint governance tokens for creators, is never forwarded to the treasury and remains in the emitter contract.
**Steps:**
1. Set creatorRateBps=1000 and entropyRateBps=5000 via dao.
2. Call `erc20TokenEmitter.buyToken{value: 100 ether}(recipients, [10000], ProtocolRewardAddresses(0,0,0))`.
3. Observe treasury balance = 87.75 ether instead of 92.625 ether.
4. Observe emitter contract retains 4.875 ether (the creators' token-purchase share).
**How found:** Code reading of buyToken's ETH accounting: noticed the treasury call only forwards toPayTreasury while totalTokensForCreators is minted from a separate ETH slice that is never transferred.
**Exploitation:** No attacker action needed; every buyToken call silently leaks the creators' token-purchase ETH into the emitter contract, underfunding the DAO treasury while governance tokens are still minted.
**Insight:** In payable functions that split msg.value across multiple recipients, verify that every computed slice is actually transferred; minted-token accounting can diverge from ETH forwarding, leaving stranded balances.