# Attack to make CurveSubject to be a HoneyPot

Curves subject creator sets a reverting referral-fee receiver so all sells revert while buys succeed, trapping holders and letting the creator dump at inflated prices.

- Payout: Contest reward
- Severity: high
- Program: Curves Protocol
- Credited: KingNFT
- Disclosed: 2024-07-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-curves-findings/issues/172
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Curves.sol _transferFees / setReferralFeeDestination
**Root cause:** _transferFees always calls referralFeeDestination even when referralFee is 0 and reverts on failure; the subject creator can set that destination to an arbitrary contract at any time.
**Steps:**
1. Creator mints subject and sets referralFeeDestination to a normal address, buys tokens cheaply.
2. Victims buy and sell normally, establishing balances.
3. Creator swaps referralFeeDestination to `EvilReferralFeeReceiver`, which reverts in `receive()` unless tx.origin's balance increased (buy-only).
4. Victim `sellCurvesToken` reverts with `CannotSendFunds()`; buys still succeed.
5. Creator allowlists self and sells holdings at elevated price.
**How found:** Code reading of _transferFees noticed the referral call executes unconditionally even with zero fee and reverts on failure, combined with creator-controlled setReferralFeeDestination.
**Exploitation:** Subject creator deploys a receiver contract that reverts on any ETH receipt unless the sender's curvesTokenBalance increased; sets it as referralFeeDestination, blocking all sells while buys continue, then sells own cheaply-acquired tokens into the trapped market.
**Insight:** When a fee/royalty recipient is user-settable and paid via a reverting-on-failure call, a malicious recipient can grief all counterflows (sells) while permitting inflows; check every user-controlled address that receives value in a shared transfer path.