# Unfair Manipulation of Winning Chances Due to Stolen Yield on `Blast`

PoolTogether on Blast: WETH prize pool yield auto-rebases, letting anyone contribute stolen yield to their vault and inflate winning odds.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: 0xSpearmint1
- Disclosed: 2024-05-10
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/114
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** PrizePool contract on Blast using WETH prize token
**Root cause:** WETH on Blast defaults to Automatic yield mode for contracts, so prize pool balance rebases; contributePrizeTokens() accepts any delta balance as contribution, letting anyone claim yield as their own vault contribution.
**Steps:**
1. Deploy on Blast with WETH prize token; WETH defaults to Automatic yield, so prizePool.balanceOf increases over time.
2. Attacker calls `contributePrizeTokens(attackerVault, yieldAmount)` where yieldAmount <= balanceOf(prizePool) - accountedBalance().
3. This adds yieldAmount to attackerVault's accumulator and totalAccumulator for the open draw.
4. Attacker's vault portion increases, raising its winning zone; other vaults' portions decrease.
**How found:** Researcher noted Blast WETH rebasing behavior and that contributePrizeTokens() accepts any unaccounted balance delta, realizing yield could be redirected to an arbitrary vault.
**Exploitation:** Attacker repeatedly calls contributePrizeTokens() with the accrued yield amount, attributing protocol-generated yield to their own vault without contributing capital, thereby increasing their share of prize draws at others' expense.
**Insight:** On rebasing-token chains like Blast, check whether contracts default to Automatic yield and whether any function treats balance delta as user contribution; configure Claimable yield and route it to a donor address.