# Balance invariant between the individual and total twabs can be broken

Transferring to SPONSORSHIP_ADDRESS in TwabController._transferBalance skips total-supply decrease, breaking the twab invariant and skewing win odds to drain the prize reserve.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: minhtrng
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/452
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TwabController._transferBalance (Solidity smart contract)
**Root cause:** When _to equals SPONSORSHIP_ADDRESS, the _to branch's total-supply increase is skipped because _toDelegate == SPONSORSHIP_ADDRESS, but the _from branch already decreased the vault total supply, so the registered total no longer matches the sum of individual delegateBalances.
**Steps:**
1. Have _from with a balance delegating to itself (default).
2. Call transfer where _to == SPONSORSHIP_ADDRESS (default _toDelegate == SPONSORSHIP_ADDRESS).
3. Observe _from branch decreases vault total supply via _decreaseTotalSupplyBalances.
4. Observe _to branch skips _increaseTotalSupplyBalances because _toDelegate == SPONSORSHIP_ADDRESS.
5. Result: sum of individual twabs > registered vault total supply.
**How found:** Code reading of _transferBalance edge cases around SPONSORSHIP_ADDRESS, noticing asymmetric total-supply adjustment between the _from and _to branches and tracing the invariant into isWinner.
**Exploitation:** Attacker repeatedly transfers to SPONSORSHIP_ADDRESS to inflate the ratio of individual twab to vault total supply; TierCalculationLib.isWinner then yields more winners than intended, draining the prize reserve faster than designed.
**Insight:** Audit special sentinel addresses (like SPONSORSHIP_ADDRESS) as transfer recipients: branches that special-case a delegate often skip the matching total-supply accounting on the opposite side, breaking sum-of-parts invariants used in randomness/odds math.