# Gas Manipulation by Malicious Winners in claimPrizes Function Medium · Sherlock · Raffle · 16th May 2024 Finding M-19 of the PoolTogether Prize Layer competition. - Protocol: https://audits.sherlock.xyz/contests/225 - Report: /reports/pooltogether-the-prize-layer-for-defi - Codebase: https://github.com/0xsimao/2024-05-pooltogether/tree/1aa1b8c028b659585e4c7a6b9b652fb075f86db3 - Source: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/163 --- ## Summary A malicious winner can exploit the `claimPrizes` function in the `Claimer` contract by reverting the transaction through returning a huge data chunk. This manipulation can cause the transaction to run out of gas, preventing legitimate claims and allowing the malicious user to claim prizes without computing winners. ## Vulnerability Detail - The `Claimer` contract allows users to claim prizes on behalf of others by calling the `claimPrizes` function. - A malicious winner can exploit this function by returning a huge data chunk when called, causing the transaction's gas to be too high and revert. - Although the function catches the revert, the remaining gas (63/64 of the original gas) is likely insufficient for the rest of the claims. - The malicious winner can then replay the transaction to claim the fees from the first claimer's computation without needing to compute the winners themselves. ## Impact - Legitimate claimers may lose gas fees due to transaction reverts caused by malicious winners. - Malicious winners can exploit this to claim prizes without computing winners, undermining the fairness of the prize distribution. ## Recommendation - Implement a gas limit check to ensure that sufficient gas remains for the rest of the claims after catching a revert. - Consider adding a mechanism to penalize or blacklist addresses that attempt to exploit this vulnerability.