# Draw auction rewards likely exceed the available rewards, resulting in overpaying rewards or running into an `InsufficientReserve` error

DrawManager's finishDraw sums start and finish reward fractions exceeding 1.0, overpaying rewards or causing InsufficientReserve error that blocks draw award.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: 0x73696d616f
- Disclosed: 2024-05-10
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/125
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AH-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** DrawManager.finishDraw reward calculation
**Root cause:** The sum of startDraw and finishDraw reward fractions can exceed 1.0 because each fraction is computed independently against availableRewards without capping the total.
**Steps:**
1. Set up DrawManager with a prize pool reserve of 0.1e18 and maxRewards cap.
2. Call `startDraw(alice, 99)` with RNG request 99; reward ~0.1e18.
3. Make RNG request 99 fail via `mockRngFailure(99, true)`.
4. Advance time and call `startDraw(bob, 100)` with RNG request 100; reward ~0.1e18.
5. Call `finishDraw(bob)`; observe emitted events showing total rewards > available reserve (overpayment) or InsufficientReserve revert.
**How found:** Manual review of the reward fraction calculation in finishDraw; noticed that startDraw and finishDraw fractions are computed independently and summed without a cap, leading to potential >1.0 total.
**Exploitation:** An attacker (or any participant) can trigger multiple startDraw calls with failing RNG, then finishDraw, causing the protocol to overpay rewards from the reserve or revert with InsufficientReserve, preventing the draw from being awarded.
**Insight:** When multiple reward fractions are computed against the same available pool, always verify that their sum cannot exceed 1.0; independent calculations can each be valid but collectively exceed the budget.