PoolTogether - valentin_s2304's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/main/pt-v5-vault/src/PrizeVault.sol#L611

Vulnerability details

Impact

function claimYieldFeeShares subtracts the whole yieldFeeBalance instead of the shares that the YieldFeeRecipient provides.

Proof of Concept

The provided functions takes as a parameter shares that will be minted to the YieldFeeRecipient. The problem is there that no matter what the shares user provides the whole yieldBalance will get to 0 instead of subtracting shares;

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

        yieldFeeBalance -= _yieldFeeBalance; //@audit this has to be -= shares

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

Tools Used

Foundry

Recommended Mitigation Steps

Change PrizeVault:L617 to yieldFeeBalance -= _shares;

Assessed type

Math