Claimer.claimPrizes calculates fee for the claiming based on prizePool.claimCount amount, without considering prizePool.canaryClaimCount amount. Because of that, fee was calculated incorrectly.
Solution
Pool together team has changed tiers managing. Now they don't have such thing as canary tier. Now every time, when someone claim prize(no matter on which tier), then claimCount is increased. And this claimCount variable is used inside Claimer.claimPrizes, which is correct.
Lines of code
Vulnerability details
Issue mitigated
About the problem
Claimer.claimPrizes
calculates fee for the claiming based onprizePool.claimCount
amount, without consideringprizePool.canaryClaimCount
amount. Because of that, fee was calculated incorrectly.Solution
Pool together team has changed tiers managing. Now they don't have such thing as canary tier. Now every time, when someone claim prize(no matter on which tier), then
claimCount
is increased. And thisclaimCount
variable is used insideClaimer.claimPrizes
, which is correct.