# Collection referrers will not receive their share of the minting fee

FeeManager._splitProtocolFee routes the collection referrer's share to the mint referrer, so collection referrers never get paid and minters can self-refer to steal the fee.

- Payout: Contest reward
- Severity: high
- Program: Titles
- Credited: 0rpse
- Disclosed: 2024-04-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-titles-judging/issues/267
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-titles%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** FeeManager._splitProtocolFee in wallflower-contract-v2
**Root cause:** In _splitProtocolFee, the collectionReferrerShare is routed to the mint referrer_ parameter instead of referrers[edition_], the stored collection referrer.
**Steps:**
1. Alice creates a referral link; Bob publishes Collection_1 via TitlesCore.publish, setting referrers[Edition_A] = Alice in FeeManager.createRoute.
2. User mints Collection_1; Edition.mint calls FeeManager._splitProtocolFee with a referrer_ argument.
3. Observe _splitProtocolFee computes collectionReferrerShare = getCollectionReferrerShare(amount_, referrers[edition_]) but routes it via `_route(Fee({asset, amount: collectionReferrerShare}), Target({target: referrer_, chainId: block.chainid}), payer_)`.
4. Both mintReferrerShare and collectionReferrerShare are sent to referrer_, so Alice receives nothing.
**How found:** Code reading of FeeManager._splitProtocolFee: noticed collectionReferrerShare is computed from referrers[edition_] but the _route target uses referrer_ instead.
**Exploitation:** A minter passes their own address as referrer_ to Edition.mint, so both the mint referrer share and the collection referrer share are routed to the minter, avoiding paying the collection referrer.
**Insight:** When a fee-split function computes a share from one address but routes it to a different parameter, check every _route target against the address used in the share calculation; referral systems with two referrer roles are prone to this copy-paste target bug.