# Tier and claim threshold bypass

Candidate tier, share, or fee values computed before or independent of the constraint that should gate them

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2023-09-27. Updated 2026-10-29._

## How it works
A function computes a candidate value (next tier count, minted share, fee cap) before or independently of the constraint meant to bound it, then returns or acts on that candidate anyway. The check runs but does not actually constrain the result. The broken assumption is that "the constraint was evaluated" equals "the constraint was honored." The candidate already encodes the change the constraint was supposed to prevent.

## Where it shows up
- Assignment to a `_next...` variable placed above the `if (threshold)` block, then returned unconditionally [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-14.md)
- Loops that mint or allocate greedily until a predicate fails, rather than honoring a configured percentage or schedule [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-24.md)
- A cap or fee derived from a global minimum (e.g. smallest tier) instead of the value being claimed [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-09.md)
- Any `x = candidate; if (cond) {...} return x;` shape where `candidate` already encodes the change

## How to review
Trace every value that mutates tier count, shares, or rewards. The invariant: the returned value must equal the pre-constraint value unless the constraint condition is true. Check that the candidate is assigned inside the gate, or that the fall-through returns the old value [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-14.md). For distribution loops, confirm the allocation honors the configured percentage rather than the slot layout [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-24.md). For incentive caps, confirm the cap scales with the claimed item's value, not a global minimum [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-09.md).

## Variants seen
- Tier expansion: `_nextNumberOfTiers = largestTierClaimed + 2` returned even when expansion-threshold checks fail; one canary claim forces growth [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-14.md)
- Founder mint skew: greedy loop over `tokenRecipient[tokenId % 100]` lets one founder burst-mint past their configured share [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-24.md)
- Fee cap misalignment: max fee tied to canary (smallest) prize size, so high prizes become unclaimable when gas exceeds minPrize [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-09.md)

## Impact and severity
Medium to high. Tier inflation distorts prize economics [E1](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-14.md); founder percentage skew breaks tokenomics [E2](https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-24.md); misaligned caps leave high-value prizes unclaimable, stranding funds [E3](https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-09.md). Severity rises when the drift is silent and compounds across claims, or when gas economics make the correct path unprofitable.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-14.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-09-nouns-builder%3AM-24.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-09.md