# User's might be able to claim their prizes even after shutdown

PoolTogether claimPrize lacks a shutdown check, letting draw winners claim prizes and also withdraw their shutdown-balance share, draining other users' funds.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: Rhaydden
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/133
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** PrizePool.sol claimPrize / withdrawShutdownBalance (Solidity prize pool)
**Root cause:** claimPrize only checks isDrawFinalized(lastAwardedDrawId) and not isShutdown(); when TWAB period length differs from draw period, shutdown via lastObservationAt can occur mid-draw, leaving the draw unfinalized so prizes remain claimable.
**Steps:**
1. Configure TwabController periodLength=1 day, PrizePool drawPeriodSeconds=2 days (valid: drawPeriod % twabPeriod == 0).
2. Warp to second-last draw start, mint TWAB tokens to user1, contribute 100e18 prize tokens, awardDraw.
3. Warp to shutdownAt() = secondLastDrawStart + drawPeriodSeconds + periodLength (mid-draw).
4. Call shutdownBalanceOf(vault,user1) to store shutdown data.
5. Call `claimPrize(user1,1,0,user1,0,address(0))` — succeeds since draw not finalized.
6. user1 then calls `withdrawShutdownBalance(vault,user1)`; other users' withdrawShutdownBalance reverts due to drained balance.
**How found:** Code review of claimPrize access checks vs withdrawShutdownBalance; noticed no shutdown guard and reasoned that differing TWAB/draw period lengths let shutdown land mid-draw, then built a Foundry PoC.
**Exploitation:** A winner of the unfinalized draw calls claimPrize after shutdown to take the prize, then withdraws their proportional shutdown balance; the reserve is reduced twice, so other users' shutdown withdrawals revert or are underfunded.
**Insight:** When a protocol has two shutdown/withdrawal paths (prize claim vs proportional shutdown balance), check whether one path is guarded by shutdown state and the other isn't; mismatched period lengths between coupled contracts can desynchronize shutdown timing from draw boundaries.