# PNFT creator fees are not enforced when buying through SPL tokens

Tensor's SPL-token buy path skipped pNFT creator-fee enforcement that the SOL path enforces, letting buyers bypass royalties and risking marketplace bans.

- Payout: Contest reward
- Severity: high
- Program: Tensor
- Credited: zigtur
- Disclosed: 2025-01-31
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solana technique:chained technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** Solana marketplace program buy_spl instruction
**Root cause:** process_buy_legacy_spl calls calc_creators_fee with optional_royalty_pct instead of forcing 100% when token standard is pNFT, unlike process_buy_legacy which checks is_royalty_enforced.
**Steps:**
1. Identify pNFT asset with enforced royalty rule set.
2. Buy via SPL-token path (buy_spl) instead of native SOL path.
3. Observe creator_fee computed with optional_royalty_pct, allowing zero/low royalty payment.
4. Compare to SOL path where is_royalty_enforced forces Some(100).
**How found:** Code review comparing process_buy_legacy (SOL) royalty enforcement against process_buy_legacy_spl, spotting the missing is_royalty_enforced check and optional_royalty_pct usage.
**Exploitation:** Buyer purchases pNFT paying with an SPL token; the program omits the enforced creator fee, so royalties are underpaid or skipped entirely, and SOL royalties can be bypassed by paying in SOL SPL token.
**Insight:** When a protocol has parallel payment paths (native vs SPL/token), diff the fee/royalty enforcement logic between them; the less-used path often drops the enforced-royalty branch.