# If the creator fee is zero and multiple creators are present the SPL sale will fail

Tensor marketplace SPL-token sales revert when a creator's royalty fee is zero and multiple creators exist, because the account iterator desyncs.

- Payout: Contest reward
- Severity: medium
- Program: Tensor
- Credited: krikolkk
- Disclosed: 2025-01-31
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.2.10
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.2.10
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solana technique:source-review vuln:business-logic

**Target:** Solana marketplace program buy_spl instruction / transfer_creators_fee
**Root cause:** transfer_creators_fee iterates creators and pulls the next account from creator_accounts only when fee>0; a zero fee skips consuming the creator's ATA, desyncing the iterator so the next creator is compared against the previous creator's ATA.
**Steps:**
1. Pass creator_accounts = [A, A_ATA, B, B_ATA] and creators = [A, B] to buy_spl.
2. First iteration: fee for A is 0, so A is matched but A_ATA is not consumed from the iterator.
3. Second iteration: iterator yields A_ATA, compared against creator B -> mismatch error.
4. Sale reverts, making buy_spl unavailable.
**How found:** Code review of transfer_creators_fee in common.rs: noticed the ATA is only pulled from the iterator inside the fee>0 branch, then traced the iterator/creator index pairing to construct a zero-fee multi-creator desync.
**Insight:** When an iterator is consumed conditionally inside a loop, check whether skipped branches leave the iterator out of sync with the parallel array; zero-value/edge amounts are the trigger.