PoolTogether - AgileJune's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/main/pt-v5-vault/src/PrizeVault.sol#L611-L622

Vulnerability details

Impact

PrizeVault.sol::claimYieldFeeShares will not work as expected if _shares < yieldFeeBalance

Proof of Concept

claimYieldFeeShares is as following.

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

==>     yieldFeeBalance -= _yieldFeeBalance;

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

yieldFeeBalance is subtracted by _yieldFeeBalance, which is same as yieldFeeBalance. As a result, if _shares < yieldFeeBalance, vault contract knows as if all remaining yieldFeeBalance is minted to fee recipient, but in reality, just _shares minted.

Tools Used

Manual Review

Recommended Mitigation Steps

Replace yieldFeeBalance -= _yieldFeeBalance;' with yieldFeeBalance -= _shares;`

Assessed type

Error