Submitted by 0x3e84fa45
Tiers can be maintained active by claiming a single prize of the last tier at a loss. The protocol will close tiers of the next draw based on the largest tier claimed of the draw being closed, which is registered during the claiming of the prizes.
This is a symptom that liquidity is being spread too thin on the last tier, and is no longer profitable for bots to claim prizes for users since their gas costs are over the claiming fees they earn.
The closing of a tier is meant to increase maxFee, which is the highest price a claiming fee can achieve in the reverse Dutch Auction mechanism; which in the current draw, isnt enough for the bot to be profitable.
The maxFee is computed based on the last active tiers prize size, and by lowering the amount of tiers, the liquidity is going to get concentrated in less tiers and in less prizes (since the number of prizes is 4^tierNumber); thus, making the bots profitable again and incentivizing them to claim prizes for users.
During the draw where there are no incentives for bots to claim prizes, prizes wont get claimed; which means that if someone won a high prize from a low tier, they would have to manually claim it. Otherwise, the liquidity of that prize will continue onto the next draw, leaving the user without a possibility of claiming their prize once the draw has passed.
A malicious actor that has deposited liquidity in the vaults that contribute to the prize pool could take advantage of this mechanic.
By having a bot that in this closing tier state claim their prizes when available and claim a single prize from the highest tier, they are able to maintain the tier active; which will cause following draws to fall again into the state where bots dont claim prizes. This hugely decreases the probability of winning for users that dont have a claiming bot while giving the malicious actor an unfair advantage.
Draw 0: closeDraw has just been executed and the remaining liquidity from the previous draw with the newly added liquidity for this draw computes a maxFee that isnt enough to cover gas costs for bots to claim prizes. Therefore, the last tier is supposed to be closed. A malicious actor can claim a random single prize from the last tier at a loss to maintain the tier active, also claiming any prizes they may have won.
Draw 1: the new liquidity is added to the system, which will make the last tiers prize size increase, and subsequently, the maxFee will increase. Depending on how much liquidity is added, maxFee will or wont be enough for bots to start claiming prizes, since the last tier has accumulated the liquidity of two draws.
It could be the case that the added liquidity isnt enough and creates a draw state similar to draw 0. To continue with the example, lets assume that the accumulated liquidity of two draws computes a maxFee that is enough to incentivize bots to claim prizes.
Draw 1 behaves as expected, which means that the last tiers liquidity would get claimed, and the following draw would rely mostly on the newly added liquidity. Mostly since there will be a remanent part of liquidity from the prizes that havent been won.
Draw 2: The situation of draw 0 repeats itself and the added liquidity on this draw is not concentrated enough to incentivize bots to claim prizes. The malicious actor claims a single prize at a loss again, to keep the tier active, also claiming any prizes they may have won.
This results in a situation where, depending on how much liquidity is added to each draw, many draws could result as inactive. Meaning, that unless users claim their own prizes, no one is going to claim them; while the malicious actor has an advantage, since their bot will claim their prizes, apart from maintaining the highest tier active.
Change the mechanism by which largestTierClaimed is set, so that its resistant to a single user performing a claim.
DoS
asselstine (PoolTogether) confirmed
Picodes (judge) decreased severity to Medium and commented:
PoolTogether mitigated:
Status: Mitigation confirmed. Full details in reports from 0xStalin, dirk_y and rvierdiiev.
