Submitted by pa6kuda, also found by 0xhunter20 and Afriauditor
https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L368-L392
https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L685
https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L619
Currently, PrizeVault.maxDeposit() calculates the maximum possible amount of deposit without taking into account produced fees. That means if there is already maxed deposited amount of asset that is calculated by the current implementation in PrizeVault.maxDeposit(), yieldFeeRecipient cant withdraw shares with PrizeVault.claimYieldFeeShares() because in that case _mint() will revert because of overflow. A lot of low-price tokens can exceed the limit of type(uint96).max with ease. For example, to make a deposit with maxDeposit() value with LADYS token its needed only $13568 (as of 08-03-2024).
If a user makes a maximum allowed deposit that is calculated by the current implementation of PrizeVault.maxDeposit(), yieldFeeRecipient cant withdraw fees if they are available.
Add this test to PrizeVault.t.sol and run with:
Add function to withdraw fees in asset or change function PrizeVault.maxDeposit() to calculate max deposit with taking into account produced fees:
Math
trmid (PoolTogether) confirmed and commented:
