Incorrect handling of yieldFeeBalance in PrizeVault.sol#claimYieldFeeBalance() function. Because yieldFeeBalance was processed incorrectly in the PrizeVault.sol#claimYieldFeeBalance() function, the recipient of the yieldFee suffers a loss.

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/main/pt-v5-vault/src/PrizeVault.sol#L611-L622

Vulnerability details

Impact

The recipient of the yieldfee might suffer a loss of the yield fee.

Proof of Concept

The PrizeVault.sol#claimYieldFeeBalance() function is as follows.

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

617     yieldFeeBalance -= _yieldFeeBalance;

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

As observed in the code snippet on the right, in L617, yieldFeeBalance is initialized to 0 irrespective of the amount of shares to be minted to the yield fee recipient.
Therefore, the recipient of the yield fee loses the fee when _shares < _yieldFeeBalance.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify the PrizeVault.sol/claimYieldFeeBalance() function as follows.

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

--      yieldFeeBalance -= _yieldFeeBalance;
++      yieldFeeBalance -= _shares;

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #10

[c4-pre-sort]

raymondfam marked the issue as duplicate of #59

[c4-judge]

hansfriese marked the issue as satisfactory