# Delegated amounts can be forcefully removed from anyone in the TwabController

Vault.sponsor accepts a zero-amount deposit for any receiver, forcing their delegation to the sponsor address and zeroing their TwabController voting power.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: 0xkasper
- Disclosed: 2023-09-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/351
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-05
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Vault.sol sponsor function / TwabController delegation
**Root cause:** sponsor() lets the caller specify an arbitrary receiver and forces delegation to the sponsorship address even when the deposited amount is 0; sponsor-address delegations are not tracked, so the victim's delegated balance drops to zero.
**Steps:**
1. Victim deposits BALANCE into vault and is self-delegated in TwabController.
2. Attacker calls `vault.sponsor(0, victim)` from any address.
3. sponsor deposits 0 for victim and forces `delegateOf(vault, victim) = address(1)`.
4. Victim's delegateBalanceOf becomes 0; sponsor address balance also 0 (untracked).
5. Repeat for all users so total delegated supply is 0; attacker delegates own funds to hold 100% of delegated supply.
**How found:** Code review of sponsor(): noticed receiver param is caller-controlled and amount can be 0, and that sponsor-address delegations are excluded from tracked supply, implying forced delegation removal.
**Exploitation:** Attacker calls sponsor with amount 0 targeting every delegator, resetting their delegated balances to zero. Attacker then delegates their own holdings, becoming 100% of the delegated supply and manipulating the lottery's random-number/delegation weighting. Repeatable anytime; victims must manually re-delegate.
**Escalation:** Mass-targeting all users drives total delegated supply to 0, giving attacker full control of delegated weight and lottery manipulation.
**Insight:** When a function lets the caller pick a receiver and force a state change (delegation), check whether the amount can be zero and whether the forced target is excluded from accounting — zero-value calls become free griefing primitives.