# The threshold check for adding of new tiers is skipped when _nextNumberOfTiers is at the maximum amount

PoolTogether PrizePool skips claim-count threshold when tier count hits max, letting a single canary claim add a new tier prematurely.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: yixxas
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/314
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-16
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** PrizePool.sol tier expansion logic
**Root cause:** Early return when _nextNumberOfTiers >= MAXIMUM_NUMBER_OF_TIERS bypasses the canary and normal claim count threshold checks, so a single canary claim at 14 tiers expands to 15.
**Steps:**
1. Have prize pool at 14 tiers.
2. Submit one canary tier claim in a draw (largestTierClaimed=13).
3. _nextNumberOfTiers = 15 >= MAXIMUM_NUMBER_OF_TIERS (15), returns 15 immediately.
4. Threshold check on canaryClaimCount and claimCount is skipped; new tier added despite insufficient claims.
**How found:** Code review of tier expansion logic; noticed early return before threshold check when _nextNumberOfTiers reaches MAXIMUM_NUMBER_OF_TIERS.
**Exploitation:** Attacker submits a single canary claim when 14 tiers exist, causing premature tier expansion without meeting claim thresholds.
**Insight:** When auditing bounded counters, check early-return branches that bypass validation; max-value edge cases often skip threshold checks.