mediumLogic errorEVM-Solidity
PoolTogether: The Prize Layer for DeFi: The RNG finish draw auction rewards are overpaid due to missing to account for the time it takes to fulfill the Witnet randomness request
- Payout
- $0
- Protocol
- PoolTogether: The Prize Layer for DeFi
- Disclosed
- Jun 6, 2024
- Source
- sherlock
PoolTogether's DrawManager computes the finish-draw auction reward from a clock that starts at startDrawAuction.closedAt, the moment the randomness request was made, rather than when the Witnet result actually becomes available 5-10 minutes later. Because the …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.