No check is done to make sure ```amount``` to be removed is not greater than poolbalance.
Summary
amount to be removed is only checked to not be equal to zero and not checked to see if greater than pool balance.
Vulnerability Details
The poolBalance (currentBalance, newBalance) is a uint256 parameter. In having an amount greater than the pool balance, the subtraction operation in the _updatePoolBalance function will result in an underflow. As a result, the updated poolBalance will wrap around to a large value instead of going negative (which is bad enough in and of itself). The contract in this case will wrongly assume that the poolBalance is sufficient to cover the amount and proceed with the token transfer.
Impact
Break in contract logic, underflow, potential loss of funds.
Tools Used
Manual Code Review
Recommendations
A check must be implemented to make sure the amount to be removed isn't greater than the current poolBalance.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.