# Gas Manipulation by Malicious Winners in claimPrizes Function

A malicious prize winner returns a huge data chunk in claimPrizes, exhausting gas so legitimate claimers revert while the attacker replays to collect fees.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0x73696d616f
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/163
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-19
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:chained technique:source-review vuln:business-logic vuln:dos

**Target:** Claimer contract claimPrizes function
**Root cause:** claimPrizes catches reverts from winner callbacks but does not bound the copied return/revert data, so a huge data chunk consumes gas and leaves insufficient gas (63/64 rule) for remaining claims.
**Steps:**
1. Attacker (a winner) makes the callback return an enormous data chunk when Claimer calls it during claimPrizes.
2. The call reverts/OOGs, consuming nearly all forwarded gas; Claimer catches the revert but only 1/64 gas remains.
3. Remaining claims in the batch fail for lack of gas, reverting the legitimate claimer's transaction.
4. Attacker replays the transaction to claim the fees from the first claimer's computation without computing winners.
**How found:** Code review of claimPrizes revert handling: noticed caught reverts still copy return data and that the 63/64 gas rule leaves too little gas for subsequent claims.
**Exploitation:** Malicious winner returns huge return data to gas-bomb the claimPrizes batch, forcing legitimate claimers to waste gas on reverts, then replays to capture the reward attributed to the original claimer.
**Insight:** When a contract catches external call reverts, check whether return/revert data copying is bounded (e.g. ExcessivelySafeCall); unbounded returndata is a gas bomb that can grief batched operations and steal the reward from the first honest executor.