# Bid field filter will never work with Token22

Tensor's take_bid Token22 path decodes the whole Mint account as TLV, so the bid field filter always fails and name-filtered bids can never be taken.

- Payout: Contest reward
- Severity: medium
- Program: Tensor
- Credited: zigtur
- Disclosed: 2025-01-31
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_tensor_nov2024.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Atensor_nov2024%3A3.2.4
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solana technique:source-review vuln:business-logic

**Target:** Solana program take_bid.rs process_take_bid_t22
**Root cause:** TlvStateBorrowed::unpack is called on the full Mint account buffer (base + TLV), but the base Mint data is not TLV-encoded, so decoding errors out.
**Steps:**
1. Set a bid field filter (Field::Name) on a bid against a Token22 mint.
2. Call take_bid; process_take_bid_t22 borrows mint_info data and runs `TlvStateBorrowed::unpack(&buffer)`.
3. unpack walks from index 0 over the base Mint bytes, hits non-zero remainder, returns InvalidAccountData.
4. Filter comparison never runs; take_bid with field filter on Token22 always fails.
**How found:** Code reading: noticed validate_mint correctly uses StateWithExtensions::unpack plus get_tlv_data, while the bid filter path unpacks TLV directly from the raw Mint buffer, implying base data is misparsed.
**Insight:** When a codebase has a correct TLV accessor (get_tlv_data after StateWithExtensions::unpack), grep for other paths that call TlvStateBorrowed::unpack on raw account data — Token22 base bytes will break them.