# Tiers can be maintained active to give unfair advantage to user through DoS

Attacker claims one last-tier prize at a loss to keep the tier open, suppressing bot claiming and denying other users their prizes.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0x3e84fa45
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/331
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-15
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium technique:source-review vuln:business-logic vuln:dos

**Target:** PrizePool tier closing / Claimer maxFee logic
**Root cause:** closeDraw sets largestTierClaimed from any single claim, so one claim on the last tier keeps it active; maxFee stays too low for bots to claim profitably.
**Steps:**
1. Observe draw where last tier's maxFee < bot gas cost, so tier should close
2. Attacker claims a single random prize from the last tier at a loss, registering largestTierClaimed
3. Tier stays active; bots remain unprofitable and stop claiming for users
4. Repeat each draw where added liquidity is insufficient to concentrate prizes
**How found:** Reasoned about the interaction between largestTierClaimed, tier closing, maxFee reverse Dutch auction, and bot profitability; noticed a single claim could pin the tier open.
**Exploitation:** Attacker runs a bot that claims its own prizes plus one last-tier prize at a loss each draw, keeping the tier open so other users' prizes go unclaimed and roll over, while attacker's own wins are always claimed.
**Insight:** When a protocol derives state (like largestTierClaimed) from any single user action, check whether one cheap action can pin that state and block a liveness-dependent mechanism such as keeper/bot incentives.