PoolTogether - radin100's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L611-L622

Vulnerability details

Impact

Potential yield shares could be lost due to applying zero value on yieldFeeBalance, no matter the _shares input value

Proof of Concept

1. yieldFeeRecipient executes 'PrizeVault::claimYieldFeeShares' with input value lower than yieldFeeBalance.
2. yieldFeeBalance goes to zero(yieldFeeBalance -= _yieldFeeBalance), no matter the input value
3. Input value shares are minted
4. yieldFeeBalance - _shares asset value is going to be wasted

Tools Used

Recommended Mitigation Steps

There are 2 main ways depending on the protocol logic to solve this issue: 1. Subtract _shares input value from yieldFeeBalance instead of _yieldFeeBalance as shown below:

function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
    if (_shares == 0) revert MintZeroShares();

    uint256 _yieldFeeBalance = yieldFeeBalance;
    if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

    --- yieldFeeBalance -= _yieldFeeBalance;
    +++ yieldFeeBalance -= _shares;
    _mint(msg.sender, _shares);

    emit ClaimYieldFeeShares(msg.sender, _shares);
}

2. Validate _shares input value not to be lower than yieldFeeBalance 3. Instead using the input value, use _yieldFeeBalance as shown below:

function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
    if (_shares == 0) revert MintZeroShares();

    uint256 _yieldFeeBalance = yieldFeeBalance;
    if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

    yieldFeeBalance -= _yieldFeeBalance; // @audit if _shares <= _yieldFeeBalance, yieldFeeBalance goes to 0?

    --- _mint(msg.sender, _shares);
    +++ _mint(msg.sender, _yieldFeeBalance);

    emit ClaimYieldFeeShares(msg.sender, _shares);
}

Assessed type

Invalid Validation