# Users can manipulate the observation creation

PoolTogether TWAB observation overwrite lets a user repeatedly deposit small amounts within one period to manipulate their recorded average balance for a draw.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: Nyx
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/334
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-13
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TWAB controller observation ring buffer (_getNextObservationIndex)
**Root cause:** New observations are only created when currentPeriod > newestObservationPeriod; deposits within the same PERIOD_LENGTH overwrite the newest observation instead of appending, so the period's average balance is not finalized until the period ends.
**Steps:**
1. Identify PERIOD_LENGTH and PERIOD_OFFSET of the TWAB controller.
2. Deposit a small amount repeatedly so currentPeriod == newestObservationPeriod, causing _getNextObservationIndex to return the existing newestObservation with shouldWrite=true (overwrite).
3. Continue until closeDraw occurs within the same period, overwriting the observation that records the balance held during the draw.
4. Observe the manipulated average balance for the final period after the draw ends.
**How found:** Code reading of _getNextObservationIndex and _getTimestampPeriod; noticed the overwrite branch triggers when currentPeriod equals newestObservationPeriod, and reasoned that same-period deposits prevent new observation creation.
**Exploitation:** Attacker makes frequent small deposits within a single period so observations are overwritten rather than appended; if a draw ends before the period ends, the attacker's recorded average balance for that draw can be altered, yielding an inaccurate TWAB used for prize accounting.
**Insight:** When a ring-buffer observation store only appends on period rollover, check whether same-period writes overwrite the latest sample and whether any consumer (draw close) reads the average before the period boundary finalizes it.