# Increasing reserves breaks PrizePool accounting

PrizePool.increaseReserve adds reserve without updating _accountedBalance, letting any vault call contributePrizeTokens to double-count the injected tokens and steal reserve funds.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: dirk\_y
- Disclosed: 2023-09-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/147
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PrizePool.sol (pt-v5-prize-pool) reserve accounting
**Root cause:** increaseReserve increments _reserve and transfers tokens in, but _accountedBalance() only derives from totalAccumulator observations minus _totalWithdrawn, so the injected tokens are not counted as accounted balance.
**Steps:**
1. Call `increaseReserve(amount)` — tokens transfer in, `_reserve += amount`, but `_accountedBalance()` unchanged.
2. Call `contributePrizeTokens(vault, amount)`; `_deltaBalance = prizeToken.balanceOf(this) - _accountedBalance()` now includes the reserve injection.
3. contributePrizeTokens credits the vault accumulator and totalAccumulator with the injected amount, double-counting tokens already counted in _reserve.
4. Over successive draws the double-counted liquidity is distributed as prizes while actual balance falls below accounted balance.
**How found:** Read the README invariant that prize token balance must equal tier liquidity plus reserve, then traced increaseReserve and _accountedBalance to find the reserve injection never enters accounted balance, breaking the invariant.
**Exploitation:** Any vault (or attacker-controlled vault) calls increaseReserve to inject tokens, then immediately calls contributePrizeTokens to have the same tokens credited to its accumulator; the reserve contribution is effectively stolen and paid out as prizes across draws.
**Insight:** When a contract tracks an 'accounted balance' invariant, audit every path that moves tokens in/out (manual reserve/liquidity injections) against the accounting formula, not just the primary draw flow.