# The claimer's fee will be stolen by the winner

Winner sets afterClaimPrize hook to reenter claimer.claimPrizes for other winners, stealing the claimer's reward fees without paying gas.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0x73696d616f
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/73
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:chained technique:incomplete-fix vuln:business-logic vuln:reentrancy vuln:reward-distribution

**Target:** Claimable.sol / Claimer contract claimPrizes
**Root cause:** Winner-controlled afterClaimPrize hook executes arbitrary logic during claimPrize, allowing reentrant calls to claimer.claimPrizes for remaining winners before the original caller's loop reaches them.
**Steps:**
1. Attacker (a winner) observes victim's `claimer.claimPrizes` tx in mempool claiming for winners [B,C,D,E,F]
2. Attacker front-runs with `setHooks` setting an `afterClaimPrize` hook that loops `claimer.claimPrizes` for [C,D,E,F]
3. Victim's tx executes; attacker's hook claims C-F first, earning their fees
4. Victim's subsequent claims for C-F revert but are caught by try-catch, so victim only earns fee for B
**How found:** Prior audit (2024-03 PoolTogether M-01) showed winner stealing claimer fees via hooks; researcher noted the fix was incomplete and applied the same idea through the afterClaimPrize hook instead.
**Exploitation:** Front-run the claimer's batch claim by installing an afterClaimPrize hook that reenters claimPrizes for the remaining winners, capturing their reward fees while the original caller pays gas.
**Insight:** When a protocol adds a fix for hook-based fee theft, check every remaining hook (before/after) and every reentrant entrypoint into the reward-paying function; try-catch around per-item claims hides reverts and lets partial theft succeed silently.