mediumLogic errorEVM-Solidity
PoolTogether: The Prize Layer for DeFi: Gas Manipulation by Malicious Winners in claimPrizes Function
- Payout
- $0
- Protocol
- PoolTogether: The Prize Layer for DeFi
- Disclosed
- Jun 6, 2024
- Source
- sherlock
PoolTogether's Claimer contract allows any account to call claimPrizes on behalf of others, invoking a callback on the winning vault. A malicious winner can make that callback return an oversized data payload, which forces the claim transaction to run out of g …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.