# yieldFeeBalance wouldn't be claimed after calling transferTokensOut()

PrizeVault's liquidatableBalanceOf caps share liquidation to the TWAB supply limit without accounting for accumulated yieldFeeBalance, so fees minted after transferTokensOut can never be claimed.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0xhunter20
- Disclosed: 2024-04-04
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-pooltogether-findings/issues/244
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-pooltogether%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** PrizeVault.sol liquidatableBalanceOf / transferTokensOut
**Root cause:** liquidatableBalanceOf checks _liquidYield against _maxAmountOut (TWAB supply limit) before applying yieldFeePercentage, so the minted yield fee shares push totalSupply to the limit and the fee balance becomes unclaimable.
**Steps:**
1. Set totalSupply=6e28, yieldFeeBalance=0, twabSupplyLimit=2^96-1≈7.9e28, vault has enough yield.
2. Call liquidatableBalanceOf(address(this)): _maxAmountOut=7.9e28-6e28=1.9e28 when _liquidYield>_maxAmountOut.
3. Call transferTokensOut() with _amountOut=1.9e28; _yieldFee is added to yieldFeeBalance.
4. totalSupply now at TWAB limit, so yieldFeeBalance can never be realized as shares.
**How found:** Code reading of liquidatableBalanceOf: noticed the TWAB supply limit comparison uses _liquidYield before yieldFeePercentage is applied, so newly accumulated yield fees are not counted against the cap.
**Insight:** When a cap is enforced on a minted-share amount, check whether the cap comparison happens before or after fee/percentage adjustments—fees minted after the cap check can strand value permanently.