PoolTogether - Mitigation Review details

• Total Prize Pool: $27,150 USDC
• Warden guidelines for C4 mitigation reviews
• Submit findings using the C4 form
• Starts August 21, 2023 20:00 UTC
• Ends August 29, 2023 20:00 UTC

Important note

Each warden must submit a mitigation review for every High and Medium finding from the parent audit that is listed as in-scope for the mitigation review. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

• H-01: The _currentExchangeRate of the Vault contract can't increase, and always be lower than or equal to _assetUnit
• H-02: Malicious user can steal other user's deposits from Vault.sol
• H-03: _amountOut is representing assets and shares at the same time in the liquidate function
• H-04: Vault.mintYieldFee FUNCTION CAN BE CALLED BY ANYONE TO MINT Vault Shares TO ANY RECIPIENT ADDRESS
• H-05: Delegated amounts can be forcefully removed from anyone in the TwabController
• H-06: Resetting delegation will result in user funds being lost forever
• H-07: _requireVaultCollateralized() is called at the beginning of the functions mintYieldFee() and liquidate()
• H-08: Increasing reserves breaks PrizePool accounting
• H-09: Vault is not compatible with some erc4626 vaults
• M-02: Unintended or Malicious Use of Prize Winners' Hooks
• M-03: TwabLib::getTwabBetween can return innacurate balances if _startTime and _endTime aren't safely bounded
• M-04: deposit function does not check for the maxMint amount.
• M-05: Balance invariant between individual and total twabs can be broken
• M-06: drawManager CAN BE SET TO A MALICIOUS ADDRESS
• M-07: In important libraries of PoolTogether, the pow() function of PRBMath is used, which exhibits inconsistent return values
• M-08: Attacker can frontrun deployVault to deploy at the same address
• M-09: High Prizes might not be claimed
• M-10: PrizePool -> Winners wouldn't be able to claim prize correctly in claimPrize function
• M-11: Vault.mintWithPermit() can be DOSed
• M-12: Tier odds in TieredLiquidityDistributor are incorrect
• M-13: Users can manipulate observation creation
• M-14: Number of prize tiers always increases if just 1 canary prize is claimed
• M-15: Tiers can be mantained active to give unfair advantage to user through DoS
• M-16: Threshold check for adding of new tiers is skipped when _nextNumberOfTiers is at the maximum
• M-18: Exchange Rate Change in Case of Lossy Strategy will cause the Vault to Undercollateralized for generic ERC4626 Yield Vaults
• M-19: Silent overflow could alter computation when calculating the vaultPortion in the PrizePool contract
• M-20: Improper handling of cases when withdrawable assets = 0
• M-21: Vault contribution calculations wrongly include the current round when claiming prizes
• M-22: Loss of precision leads to undercollateralized
• M-23: Vault does not conform to ERC4626
• M-24: Claimer.claimPrizes can be frontrunned in order to make losses for the claim bot
• M-25: depositWithPermit and mintWithPermit are allowed to be called by permit creator only
• M-26: Transfer of Vault tokens can cause accounting errors in other contracts
• M-27: Inconsistent behavior for canary claims in claimer

Overview of changes

• Twab Controller now checks query timestamps for safety. When requesting a twab, timestamps:
  1. are required to be finalized; i.e. cannot occur during an overwrite period
  2. are aligned to period boundaries.
• Tier adjustment algorithm
  1. The canary tier has been simplified, so that the prize size is adjusted instead of the number of prizes. Now the unified claim count across normal + canary tiers is used to determine the next number of tiers.
• Vault exchange rate
  1. The Vault now assumes shares are 1:1 with underlying assets, unless the vault is undercollateralized. No exchange rate is stored.

Mitigations to be reviewed

Branch

• pt-v5-prize-pool
• pt-v5-twab-controller
• pt-v5-vault
• pt-v5-claimer

(all PRs have been merged into main)

Individual PRs

Out of Scope