# PoolTogether Prize Layer audit contest Sherlock · Raffle · 16th May 2024 · #1 A public audit contest on Sherlock (raffle), completed on 16th May 2024. 0xSimao placed #1. 12 of his findings are published: 2 high severity and 10 medium. ## What PoolTogether: The Prize Layer for DeFi is PoolTogether is a no-loss prize savings protocol: deposits earn yield through ERC-4626 vaults, the yield funds prize draws across tiers, and winners are determined from an RNG feed with claimers racing to execute claims for a fee. ## Scope The Sherlock competition covered the prize layer's tier and claim machinery: prize-portion accounting across tiers, reward reserves versus what running draws demand, RNG retry flows, and the vaults' ERC-4626 compliance. ## High severity findings - [Vault portion calculation in `PrizePool::getVaultPortion()` is incorrect as `_startDrawIdInclusive` has been erased](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-portion-prize-inclusive-erased) - [Draw auction rewards likely exceed the available rewards, resulting in overpaying rewards or running into an `InsufficientReserve` error](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-rewards-exceed-running-insufficient) ## Medium severity findings - [Estimated prize draws in TieredLiquidityDistributor are off due to rounding down when calculating the sum, leading to incorrect prizes](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-estimated-draws-tiered-rounding) - [`Claimers` can receive less `feePerClaim` than they should if some prizes are already claimed or if reverts because of a reverting hook](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimers-fee-reverts-hook) - [Witnet is not available on some networks listed](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-witnet-available-networks-listed) - [`DrawManager.canStartDraw` does not consider retried RNG requests when determining if a new draw auction can be started](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-retried-rng-determining-started) - [`maxDeposit` doesn't comply with ERC-4626](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-deposit-comply-erc-4626) - [Gas Manipulation by Malicious Winners in claimPrizes Function](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-gas-manipulation-winners-prizes) - [Price formula in `TpdaLiquidationPair._computePrice()` does not account for a jump in liquidatable balance](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-price-tpda-liquidation-compute) - [The claimer's fee will be stolen by the winner](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-claimer-fee-stolen-winner) - [Potential ETH Loss Due to transfer Usage in Requestor Contract on `zkSync`](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-eth-transfer-requestor-sync) - [DoSed liquidations as `PrizeVault::liquidatableBalanceOf()` does not take into account the `mintLimit` when the token out is the asset](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-liquidations-prize-liquidatable-mint) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/225)