# PoolTogether: Case Study 1 review · 1 report · 12 findings > “0xSimao, during his audit with PoolTogether, was the sole auditor to discover a complex, high-severity issue that demonstrated his experience and deep understanding of the codebase. His thorough review was instrumental in ensuring the security and longevity of the core protocol.” **What it is.** PoolTogether is a no-loss prize savings protocol: deposits earn yield, the yield funds prizes, and a periodic draw decides who wins. **What was reviewed.** One competition on the prize layer, May 2024, first place, over the prize pool, the draw auctions and the vault accounting. ## What was found 12 findings, 2 of them high severity, and one of those was the only high severity issue in the competition that none of the more than 400 other participants found. ## Featured finding PoolTogether decides who wins by weighing what each vault contributed over a long stretch of past draws. Those contributions are kept in fixed size ring buffers, one for the running total and one for each vault, and the stretch is long enough that the total buffer has already wrapped and overwritten its oldest draw while the vault buffers have not. A vault was therefore measured over a longer period than the total it was being compared against, so its share of the prize came out larger than it had earned, and where the overwritten draw carried a donation the arithmetic underflowed and the prize could not be claimed at all. [See the whole finding](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-portion-prize-inclusive-erased) ## Engagement history | Date | Kind | With | Findings | Report | |---|---|---|---|---| | 2024-05-16 | Competition · #1 | Sherlock | [12](https://0xsimao.com/findings#pooltogether-the-prize-layer-for-defi-2024-05-16) | [report](https://github.com/0xsimao/audits/blob/main/Sherlock/contests/2024-05-16-pooltogether-the-prize-layer-for-defi.md) |