# Vault contribution calculations wrongly include the current round when claiming prizes

PrizePool._computeVaultTierDetails includes the current in-progress draw in vault contribution window, letting a vault inflate its odds by contributing right before claiming.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: dirk\_y
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/150
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-21
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** PrizePool.sol prize claim vault-portion calculation
**Root cause:** _getVaultPortion is called with an inclusive end of _lastClosedDrawId + 1 and start of _lastClosedDrawId - drawDuration + 1, so the not-yet-distributed current round is counted and the start round is off by one.
**Steps:**
1. Draw manager calls `closeDraw`; `_nextDraw` uses `_contributionsForDraw(lastClosedDrawId + 1)` before incrementing lastClosedDrawId.
2. Vault calls `claimPrize`; `_computeVaultTierDetails` computes vaultPortion via `_getVaultPortion(vault, drawDuration > lastClosedDrawId ? 0 : lastClosedDrawId - drawDuration + 1, lastClosedDrawId + 1, smoothing)`.
3. Range is inclusive, so contributions from the current in-progress round (not yet dispersed to tiers) are included, inflating the vault's portion.
4. Vault contributes prize tokens in a recent round before claiming to swing odds toward its users, especially in frequent high tiers.
5. Fix: use start `lastClosedDrawId - drawDuration` and end `lastClosedDrawId`.
**How found:** Code reading of the draw-close vs claim paths: noticed closeDraw computes contributions for lastClosedDrawId+1 before incrementing, while claim computes vault portion with an inclusive range ending at lastClosedDrawId+1, revealing an off-by-one window including the current round.
**Exploitation:** A vault contributes prize tokens to the prize pool in a recent round, then claims prizes; because the current round's contributions are counted before being distributed, the vault's portion (and thus its users' odds) is inflated.
**Insight:** When a contribution/odds window is computed with an inclusive [start, end] range, check whether the end draw has actually been closed and distributed; off-by-one in inclusive ranges silently credits undistributed rounds.