# Royalties don't work with Token-2022

Tensor AMM's creator royalty transfer hardcodes the legacy SPL Token program ID, so royalty payouts in Token-2022 tokens fail, DoSing swaps and marketplace sales.

- Payout: Contest reward
- Severity: high
- Program: Tensor
- Credited: Christoph Michel
- Disclosed: 2025-01-31
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.1.4
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.1.4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:high tech:solana technique:source-review vuln:business-logic vuln:dos

**Target:** Solana Anchor AMM royalty distribution (transfer_creators_fee in toolbox/src/common.rs)
**Root cause:** transfer_creators_fee calls anchor_spl::token::transfer, which hardcodes spl_token::ID in the instruction instead of using the passed token_program account, so Token-2022 mints route the transfer to the wrong program.
**Steps:**
1. List an NFT or swap on Tensor AMM with a Token-2022 mint as the payment currency.
2. Trigger a sale/swap that invokes transfer_creators_fee in toolbox/src/common.rs.
3. Observe anchor_spl::token::transfer builds the instruction with `&spl_token::ID` regardless of the token_program account passed in CpiContext.
4. Transaction fails because the Token-2022 mint is not owned by the legacy SPL Token program.
**How found:** Code review of transfer_creators_fee: noticed the dynamic token_program account is passed but anchor_spl::token::transfer ignores it, reading the anchor/spl source to confirm spl_token::ID is hardcoded.
**Exploitation:** Not an attacker-driven exploit; any user transacting with a Token-2022 payment token triggers the failing CPI, causing royalty payout failure and transaction DoS.
**Insight:** When an Anchor program accepts a token_program account for Token-2022 support, verify every CPI uses token_interface (transfer_checked) rather than anchor_spl::token helpers, which silently hardcode the legacy program ID.