PoolTogether - wangxx2026's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L617

Vulnerability details

Impact

can result in the loss of the YieldFee

Proof of Concept

Here is the implementation of the claimYieldFeeShares method:

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

        yieldFeeBalance -= _yieldFeeBalance; // @audit yieldFeeBalance equals _yieldFeeBalance The result will be 0 

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

After claiming the shares of _shares, the remainder should be yieldFeeBalance = _yieldFeeBalance - _shares We can see that the code implements

yieldFeeBalance -= _yieldFeeBalance;

_yieldFeeBalance is a copy of yieldFeeBalance, so no matter what the number of _shares is, the yieldFeeBalance after implementation is 0. If _shares < yieldFeeBalance, fees not withdrawn will be lost.

POC: Place the unit test testTotalDebt_IncreasesWithYieldFeeAccrualAndDecreasesWithFeeClaims of 162 line modified to:

vault.claimYieldFeeShares(1);

Run: forge test --mt testTotalDebt_IncreasesWithYieldFeeAccrualAndDecreasesWithFeeClaims -vvvvv Resulting pass

Tools Used

Manual Revew && Foundry

Recommended Mitigation Steps

Modify L167 to:

yieldFeeBalance = _yieldFeeBalance - _shares;

Assessed type

Error