# Any fee claim lesser than the total yieldFeeBalance as unit of shares is lost and locked in the PrizeVault contract

PrizeVault.claimYieldFeeShares subtracts the full yieldFeeBalance instead of the claimed amount, so partial fee claims wipe the remainder and lock unclaimed shares.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: DarkTower
- Disclosed: 2024-04-04
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-pooltogether-findings/issues/59
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-pooltogether%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** PrizeVault.claimYieldFeeShares (Solidity vault contract)
**Root cause:** claimYieldFeeShares caches yieldFeeBalance into _yieldFeeBalance and subtracts the entire cached balance (`yieldFeeBalance -= _yieldFeeBalance`) rather than the claimed `_shares`, zeroing accounting while minting only _shares.
**Steps:**
1. Deploy PrizeVault with yield fee recipient bob, setYieldFeePercentage(1e8) (10%).
2. Alice deposits 100e18; mint 100e18 yield to vault and liquidate half via transferTokensOut, accruing yieldFeeBalance ~4.999e18.
3. As bob call `claimYieldFeeShares(1e17)` (less than yieldFeeBalance).
4. Observe yieldFeeBalance reset to 0 while bob only minted 1e17 shares; remainder ~4.9e18 shares lost/locked.
**How found:** Code review of claimYieldFeeShares: noticed the subtraction uses the cached total `_yieldFeeBalance` instead of the `_shares` argument, then wrote a Foundry PoC to confirm partial claims zero out the remainder.
**Exploitation:** Fee recipient (or any partial claim) calls claimYieldFeeShares with _shares below yieldFeeBalance; the full balance is deducted from accounting but only _shares minted, permanently locking the difference in the vault with no recovery path.
**Insight:** When auditing claim/withdraw functions, check that state decrements match the user-supplied amount, not a cached total; partial-claim paths are where accounting mismatches hide.