# The NFT marketplace allows listing legacy tokens that are not NFTs

Tensor's list_legacy instruction only checks zero decimals, letting sellers list fungible mints and re-mint after sale, tricking buyers expecting NFTs.

- Payout: Contest reward
- Severity: medium
- Program: Tensor
- Credited: zigtur
- Disclosed: 2025-01-31
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.2.1
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:solana technique:source-review vuln:business-logic

**Target:** Solana marketplace program list_legacy instruction / token_metadata transfer
**Root cause:** The toolbox transfer function only validates decimals == 0 via transfer_checked, omitting checks that mint supply is 1 and mint authority is unset, so fungible mints pass as NFTs.
**Steps:**
1. Call `list_legacy` with a mint that has decimals=0 but supply>1 and an active mint authority
2. process_list_legacy invokes toolbox `transfer`, which only asserts metadata and calls `transfer_checked(ctx, 1, 0)`
3. Listing succeeds despite token not being an NFT
4. Buyer purchases expecting an NFT; seller retains mint authority and mints more supply
**How found:** Read Metaplex NFT definition (supply 1, zero decimals, no mint authority) and compared against the transfer code, noticing only the decimals check was implemented while comments imply an NFT is expected.
**Exploitation:** Seller lists a fungible zero-decimal token as if it were an NFT; after a buyer purchases it, the seller uses the retained mint authority to mint additional tokens, diluting/defrauding the buyer.
**Insight:** When a program validates a token standard, enumerate every property of that standard (supply, decimals, mint/freeze authority) and check each is enforced in code, not just the one the CPI helper checks.