PoolTogether: The Prize Layer for DeFi audit
Audit competition · firm’s term: public contest
Sherlock reviewed PoolTogether (PoolTogether: The Prize Layer for DeFi audit) on 6 Jun 2024: 22 findings, 0 critical; 14 marked fixed, 8 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 8 | 11 |
| Low | 0 | 0 | 0 |
HighDraw auction rewards likely exceed the available rewards, resulting in overpaying rewards or running into an InsufficientReserve errorFixed
The report gives no description here.
HighUnfair Manipulation of Winning Chances Due to Stolen Yield on BlastFixed
The report gives no description here.
HighVault portion calculation in PrizePool::getVaultPortion() is incorrect as _startDrawIdInclusive has been erasedFixed
The report gives no description here.
MediumClaimers Cannot Claim Prizes When Last Tier Liquidity is 0, Preventing Winners from Receiving Their PrizesFixed
The report gives no description here.
MediumDoSed liquidations as PrizeVault::liquidatableBalanceOf() does not take into account the mintLimit when the token out is the assetFixed
The report gives no description here.
MediumDrawManager.canStartDraw does not consider retried RNG requests when determining if a new draw auction can be startedFixed
The report gives no description here.
MediumDraws can be retried even if a random number is available or the current draw has finishedFixed
The report gives no description here.
MediumdrawTimeoutAt() causes the prize pool to shutdown one draw earlierFixed
The report gives no description here.
MediumGas Manipulation by Malicious Winners in claimPrizes FunctionFixed
The report gives no description here.
MediummaxDeposit doesn't comply with ERC-4626Fixed
The report gives no description here.
Show 4 more
MediummaxRedeem doesn't comply with ERC-4626Fixed
The report gives no description here.
MediumPotential ETH Loss Due to transfer Usage in Requestor Contract on zkSyncFixed
The report gives no description here.
MediumThe claimer's fee will be stolen by the winnerFixed
The report gives no description here.
MediumUser's might be able to claim their prizes even after shutdownFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of PoolTogether’s security record
PoolTogetherSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us