Delegations staked with a _to parameter not equal to the _delegator lose out on rewards

Lines of code Vulnerability details Impact If an account wishes to stake with a delegator that it did not create with the account, the delegator is unable to use the staked tickets and the tickets will sit idle in the TWABDelegator until the staker realizes that he/she gets no rewards and can onl...

TWABDelegator allows easy circumvention of whale protection

Lines of code Vulnerability details In a recent interview, PoolTogether co-founder Leighton Cusack said: “Someone who had $1,000 right now into the USDC prize pool would have a 0.01% chance of winning a prize every week. That’s a less than 1% chance of winning a prize a year,” Cusack said. “With...

Using transfer instead of safeTransfer allows attacker to steal all staked tokens

Lines of code Vulnerability details Impact An attacker can drain all staked tickets. Proof of Concept In the withdrawDelegationToStake function the user can transfer from one of his delegations to the TWABDelegator contract and receive vault tokens he can then unstake to get his tickets back...