# The RNG finish draw auction rewards are overpaid due to missing to account for the time it takes to fulfill the Witnet randomness request

PoolTogether DrawManager computes finish-draw auction reward from startDrawAuction.closedAt, ignoring the 5-10 min Witnet RNG relay delay, so finish-draw rewards are always overpaid.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: berndartmueller
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/126
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** DrawManager.finishDraw / _computeFinishDrawReward (Solidity, Witnet RNG)
**Root cause:** The finish-draw PFDA auction elapsed time is measured from startDrawAuction.closedAt (when the RNG request was made) rather than when the randomness result became available, so the 5-10 minute Witnet fulfillment delay is wrongly counted as auction time.
**Steps:**
1. Read DrawManager.finishDraw: `_computeFinishDrawReward(startDrawAuction.closedAt, block.timestamp, availableRewards)` at lines 338-342.
2. Note startDrawAuction.closedAt is set when startDraw closes and the RNG request is made.
3. Observe Witnet randomness result is only available 5-10 minutes later, so block.timestamp - closedAt always includes that relay delay.
4. PFDA price rises with elapsed time, so the reward is systematically inflated versus the intended auction start.
5. Compare against PoolTogether docs stating the finish auction should rise only once the random number is available.
**How found:** Code reading of the reward calculation in finishDraw, cross-referencing the Witnet docs' 5-10 minute randomness fulfillment delay and the protocol's own draw-auction timing documentation to spot the mismatched auction start timestamp.
**Insight:** When an auction or reward curve is keyed to an external oracle's callback, check whether the elapsed-time anchor is the request time or the fulfillment time; asynchronous oracle latency silently inflates incentive payouts.