MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Claim cut misses validation for time.

enchev

Summary

Claim cut misses validation for time allowing to claim reward after the 90 days period.

Vulnerability Details

The method Pot::claimCut is responsible for claiming rewards. The documentation states that the claims must be done in 90 day period of time but that is not implemented.

Impact

User can claim tokens even after the 90 day period of time and pot has been closed.

Tools Used

Manual review, Foundry

Proof Of Concept

Follow these steps to reproduce the issue:

  • Add the following member to TestMyCut:

address player3 = makeAddr("player3");
address player4 = makeAddr("player4");
address[] players_distributionExample = [player1, player2, player3, player4];
uint256[] rewards_distributionExample = [100, 300, 300, 400];
uint256 totalRewards_distributionExample = 1100;

  • Add the following method to TestMyCut:

function test_claimAfterClose() public mintAndApproveTokens {
ERC20Mock(weth).mint(user, STARTING_USER_BALANCE);
ERC20Mock(weth).approve(user, STARTING_USER_BALANCE);
vm.startPrank(user);
contest = ContestManager(conMan).createContest(
players_distributionExample, rewards_distributionExample, IERC20(ERC20Mock(weth)), totalRewards_distributionExample
);
ContestManager(conMan).fundContest(0);
totalContests = ContestManager(conMan).getContests();
vm.stopPrank();
​
ERC20Mock(weth).approve(conMan, STARTING_USER_BALANCE);
​
​
// Close contest - distribute rewards amount users who claimed.
vm.warp(91 days);
​
vm.startPrank(user);
ContestManager(conMan).closeContest(contest);
vm.stopPrank();
​
// This claim does not revert.
vm.startPrank(player2);
Pot(contest).claimCut();
vm.stopPrank();
}

  • Run the test via the following command: forge test --mt test_claimAfterClose

Recommendations

Add time validation for claiming in Pot.sol:

error Pot__StillOpenForClaim();
+ error Pot__ClaimPeriodHasPassed();
​
address[] private i_players;
function claimCut() public {
+ if (block.timestamp - i_deployedAt > 90 days) {
+ revert Pot__ClaimPeriodHasPassed();
+ }
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.