MyCut

Summary

The tokens sent to ContestManager contract as a part of the manager's cut from the Pot contract are unclaimable by the ContestManager's owner.

Vulnerability Details

When function ContestManager::closeContest() is successfully called by the ContestManager's Owner (we will refer to this actor as Owner, assuming that they are an EOA), the related Pot contract will execute Pot::closePot(). Since the Pot's owner is ContestManager, then the manager's cut (calculated on line 54) is transferred to the ContestManager contract on line 55.

Since there is no way for the Owner to claim the assets that now belong to the ContestManager, then the assets are forever locked and unclaimable.

Impact

Loss of assets that should have been owned by the Owner.

Tools Used

Manual review.

Recommendations

Consider transferring the assets to the Owner once they are received by the ContestManager contract. Alternatively, provide a function for the Owner to claim the assets manually.