PoolTogether - y4y's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L617

Vulnerability details

Impact

Incorrect amount of value will be decreased for yieldFeeBalance, and can potentially cause lose of share a recipient can get.

Proof of Concept

In function claimYieldFeeShares, fee recipient claims the yield fees and will be minted for equal amount of shares asked for:

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

        yieldFeeBalance -= _yieldFeeBalance;

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

But, in the function, yield balance is not decreased by the shares claimed for, instead, it's deducted by _yieldFeeBalance, which is essentially itself as:

uint256 _yieldFeeBalance = yieldFeeBalance;

This will clear out all yield balance, despite shares claimed may not be all of the yield fees. This will cause fee recipient receive less shares than expected.

Tools Used

Manual review.

Recommended Mitigation Steps

Change the deduction to:

yieldFeeBalance -= _shares;

Assessed type

Context