PoolTogether Prize Layer audit contest

A public audit contest on Sherlock (raffle), completed on 16th May 2024. 0xSimao placed #1. 12 of his findings are published: 2 high severity and 10 medium.

What PoolTogether: The Prize Layer for DeFi is

PoolTogether is a no-loss prize savings protocol: deposits earn yield through ERC-4626 vaults, the yield funds prize draws across tiers, and winners are determined from an RNG feed with claimers racing to execute claims for a fee.

Scope

The Sherlock competition covered the prize layer's tier and claim machinery: prize-portion accounting across tiers, reward reserves versus what running draws demand, RNG retry flows, and the vaults' ERC-4626 compliance.

High severity findings

• Vault portion calculation in PrizePool::getVaultPortion() is incorrect as _startDrawIdInclusive has been erased
• Draw auction rewards likely exceed the available rewards, resulting in overpaying rewards or running into an InsufficientReserve error

Medium severity findings

• Estimated prize draws in TieredLiquidityDistributor are off due to rounding down when calculating the sum, leading to incorrect prizes
• Claimers can receive less feePerClaim than they should if some prizes are already claimed or if reverts because of a reverting hook
• Witnet is not available on some networks listed
• DrawManager.canStartDraw does not consider retried RNG requests when determining if a new draw auction can be started
• maxDeposit doesn't comply with ERC-4626
• Gas Manipulation by Malicious Winners in claimPrizes Function
• Price formula in TpdaLiquidationPair._computePrice() does not account for a jump in liquidatable balance
• The claimer's fee will be stolen by the winner
• Potential ETH Loss Due to transfer Usage in Requestor Contract on zkSync
• DoSed liquidations as PrizeVault::liquidatableBalanceOf() does not take into account the mintLimit when the token out is the asset

The contest

View the contest page