Delegate to the sponsor without `PrizeVault#sponsor` function.

Low/Info issue submitted by Laksmana

Summary

without PrizeVault#sponsor function. anyone can Delegate to the sponsor address

Vulnerability Detail

The PrizeVault#sponsor is function that do deposit&mint while delegating to the sponsor's address..

 function sponsor(uint256 _assets) external returns (uint256) {
        address _owner = msg.sender;

        uint256 _shares = previewDeposit(_assets);
        _depositAndMint(_owner, _owner, _assets, _shares);

        if (twabController.delegateOf(address(this), _owner) != SPONSORSHIP_ADDRESS) {
            twabController.sponsor(_owner);
        }

        emit Sponsor(_owner, _assets, _shares);

        return _shares;
    }

that function trigger twabController.sponsor.

 function delegate(address _vault, address _to) external {
    _delegate(_vault, msg.sender, _to);
  }

function sponsor(address _from) external {
    _delegate(msg.sender, _from, SPONSORSHIP_ADDRESS);
  }

Look carefully, TwabController#delegate can also perform the same activity, "delegating to the sponsor address" by filled _to is SPONSORSHIP_ADDRESS.

This means PrizeVault#sponsor becomes useless.

Impact

The “delegate to sponsor address” feature has become more flexible. Users can choose to delegate to a sponsor whenever they want without needing to deposit again, this contrasts with the PrizeVault#sponsor function which requires depositing assets simultaneously.

Therefore PrizeVault#sponsor becomes useless.

Code Snippet

https://github.com/sherlock-audit/2024-05-pooltogether/blob/1aa1b8c028b659585e4c7a6b9b652fb075f86db3/pt-v5-vault/src/PrizeVault.sol#L558-L571

https://github.com/sherlock-audit/2024-05-pooltogether/blob/1aa1b8c028b659585e4c7a6b9b652fb075f86db3/pt-v5-twab-controller/src/TwabController.sol#L524-L526

Tool used

Manual Review

Recommendation

 function delegate(address _vault, address _to) external {
if(_to ==SPONSORSHIP_ADDRESS) revert();
    _delegate(_vault, msg.sender, _to);
  }

sherlock-audit / 2024-05-pooltogether-judging