# A NFT creator can deny a SPL token buy operation

Tensor's buy_spl transfer_creators_fee uses create_idempotent on the creator's ATA, so a creator who changes their ATA owner can block all SPL-token buys.

- Payout: Contest reward
- Severity: medium
- Program: Tensor
- Credited: zigtur
- Disclosed: 2025-01-31
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.2.3
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solana technique:source-review vuln:business-logic vuln:dos

**Target:** Solana NFT marketplace buy_spl instruction (creator fee transfer)
**Root cause:** transfer_creators_fee calls associated_token::create_idempotent, which fails when the creator's ATA exists but is not owned by the creator; the Token program (unlike Token22) lets the owner reassign ATA ownership.
**Steps:**
1. Creator holds an ATA for the payment mint whose owner is set to a different account (via Token program SetAuthority on the account owner).
2. Buyer invokes buy_spl with CreatorFeeMode::Spl for that creator.
3. transfer_creators_fee CPIs create_idempotent with authority=creator; the instruction fails because the existing ATA is not owned by the creator.
4. The whole buy transaction reverts, denying the purchase.
**How found:** Code review of buy_spl.rs: noticed create_idempotent is used to ensure the creator ATA, and reasoned that idempotent creation fails when an existing ATA has a mismatched owner; confirmed the Token program permits owner reassignment while Token22's immutable-owner feature does not.
**Exploitation:** A malicious creator reassigns ownership of their payment-mint ATA to an account they control, causing every SPL-token buy routed through transfer_creators_fee to revert; they can restore ownership to re-enable buys, giving them a griefing toggle over sales.
**Insight:** When a program relies on create_idempotent to guarantee an ATA, remember it only succeeds if the existing account is already owned by the expected authority; any party able to change ATA ownership (plain SPL Token, not Token22) can turn that CPI into a DoS switch.