# TwabLib::getTwabBetween can return inaccurate balances if _startTime and _endTime aren't safely bound

PrizePool calls TwabLib.getTwabBetween without isTimeRangeSafe, so unclosed-period timestamps yield extrapolated TWABs and unfair prize distribution.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: Infect3d
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/464
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-03
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TwabController TwabLib.getTwabBetween via PrizePool._getVaultUserBalanceAndTotalSupplyTwab
**Root cause:** getTwabBetween extrapolates from the previous observation when timestamps aren't exact matches, and its documented isTimeRangeSafe precondition is not enforced by PrizePool before querying balances for winner selection.
**Steps:**
1. Read TwabLib.getTwabBetween docs: timestamps must be safe via isTimeRangeSafe; otherwise balance is extrapolated from previous observation.
2. Inspect PrizePool._getVaultUserBalanceAndTotalSupplyTwab: computes _endTimestamp = _lastClosedDrawStartedAt + drawPeriodSeconds and _startTimestamp = _endTimestamp - _drawDuration*drawPeriodSeconds.
3. Observe no isTimeRangeSafe check before twabController.getTwabBetween / getTotalSupplyTwabBetween.
4. Query a range whose end is not a period-end/observation boundary so extrapolated TWAB is returned.
5. PrizePool.isWinner/claimPrize uses that inaccurate TWAB, mis-selecting winners.
6. Fix: require(twabController.isTimeRangeSafe(...)) before querying.
**How found:** Code-reading: noticed the dev comment referencing isTimeRangeSafe in getTwabBetween's NatSpec and checked the PrizePool caller, finding the documented precondition unenforced.
**Exploitation:** No concrete attack flow given; impact is that prize claims may be evaluated against extrapolated (inaccurate) TWAB values, awarding or denying prizes incorrectly.
**Insight:** When a library function's NatSpec names a safety precondition (e.g. 'ensure timestamps are safe using isTimeRangeSafe'), grep every caller and verify the check is actually performed—extrapolation fallbacks silently return plausible-but-wrong values.