function claimYieldFeeShares subtracts wrongly

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/main/pt-v5-vault/src/PrizeVault.sol#L611

Vulnerability details

Impact

function claimYieldFeeShares subtracts the whole yieldFeeBalance instead of the shares that the YieldFeeRecipient provides.

Proof of Concept

The provided functions takes as a parameter shares that will be minted to the YieldFeeRecipient. The problem is there that no matter what the shares user provides the whole yieldBalance will get to 0 instead of subtracting shares;

    function claimYieldFeeShares(uint256 _shares) external onlyYieldFeeRecipient {
        if (_shares == 0) revert MintZeroShares();

        uint256 _yieldFeeBalance = yieldFeeBalance;
        if (_shares > _yieldFeeBalance) revert SharesExceedsYieldFeeBalance(_shares, _yieldFeeBalance);

        yieldFeeBalance -= _yieldFeeBalance; //@audit this has to be -= shares

        _mint(msg.sender, _shares);

        emit ClaimYieldFeeShares(msg.sender, _shares);
    }

Tools Used

Foundry

Recommended Mitigation Steps

Change PrizeVault:L617 to yieldFeeBalance -= _shares;

Assessed type

Math

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #10

[c4-pre-sort]

raymondfam marked the issue as duplicate of #59

[c4-judge]

hansfriese changed the severity to 3 (High Risk)

[c4-judge]

hansfriese marked the issue as satisfactory