# The winner can steal claimer fees, and force him to pay for the gas

Winner's beforeClaimPrize hook reenters Claimer.claimPrizes with zero fees, claiming their own prize on the claimer's gas and denying the claimer its fee.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: Al-Qa-qa
- Disclosed: 2024-04-04
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-03-pooltogether-findings/issues/345
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-pooltogether%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reentrancy vuln:reward-distribution

**Target:** PrizeVault Claimable hook + Claimer contract
**Root cause:** Claimable.claimPrize invokes the winner-controlled beforeClaimPrize hook before claiming, and the hook can reenter the permissionless Claimer.claimPrizes to claim the same prize with zero fees; the outer claim then returns 0 without reverting.
**Steps:**
1. Winner sets a VaultHooks with useBeforeClaimPrize=true.
2. MEV searcher calls `Claimer.claimPrizes([winner,...], tier, feePerClaim, feeRecipient)`.
3. Claimer calls `Claimable.claimPrize(winner, tier, prizeIndex, fee, feeRecipient)`.
4. Claimable invokes `beforeClaimPrize{gas:150_000}` on winner's hook.
5. Hook calls `Claimer.claimPrizes([winner], 0, 0, rewardRecipient)` with zero fees; inner claim succeeds and pays full prize to winner.
6. Hook returns winner address; outer `PrizePool.claimPrize` returns 0, Claimer emits AlreadyClaimed and pays no fee.
7. Gas measured: inner claim ~123k < 150k HOOK_GAS, so no OOG.
**How found:** Reading Claimable.claimPrize saw the winner-controlled beforeClaimPrize hook executes before the prize is claimed, and that Claimer.claimPrizes is permissionless with caller-set fees; hypothesized reentrancy through the hook to pre-claim with zero fee, then measured gas (~123k) to confirm it fits under HOOK_GAS=150k.
**Exploitation:** Attacker (winner) registers a beforeClaimPrize hook that reenters the permissionless Claimer with zero fee and only their own prize params. When any MEV searcher/claimer submits claimPrizes for a batch including the attacker, the hook claims the prize first at zero fee, so the outer claim yields 0 and the searcher earns no fee while paying gas.
**Insight:** When a user-controlled hook runs before state-changing settlement and the settlement entrypoint is permissionless with caller-supplied fee, check whether the hook can reenter to settle first at zero fee; also budget the hook gas limit against the inner call cost to confirm feasibility.