# `drawTimeoutAt()` causes the prize pool to shutdown one draw earlier

drawTimeoutAt() returns a shutdown timestamp one draw period early, so PrizePool shuts down after drawTimeout-1 missed draws, blocking awards.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: MiloTruck
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** PrizePool.sol drawTimeoutAt() / awardDraw()
**Root cause:** drawTimeoutAt() computes drawClosesAt(_lastAwardedDrawId + drawTimeout), but draws can only be awarded after their close time, so the shutdown timestamp lands one draw period too early.
**Steps:**
1. Set drawTimeout=1, _lastAwardedDrawId=0; first draw to award is drawId=1.
2. Call `awardDraw()` before close of drawId=1: reverts AwardingDrawNotClosed.
3. Call `awardDraw()` during/after drawId=2: drawTimeoutAt() returns close time of drawId=1, already passed, so notShutdown modifier reverts.
4. Result: awardDraw() can never succeed; pool shuts down with zero missed draws.
**How found:** Code reading of drawTimeoutAt() against the awardDraw() timing check: noticed the shutdown timestamp equals the close time of the draw being awarded, which is only reachable after that draw's close, making the award impossible.
**Insight:** When a timeout/deadline is derived from a draw/epoch id, verify it against the earliest block at which the guarded action can legally execute; off-by-one in epoch arithmetic silently disables the action entirely.