MyCut

Summary

The transfer logic assumes that it will never face failure when transfering.

Vulnerability Details

The method Pot::_transferReward is responsible for sending rewards to claimants. However, it does not check if the transfer was successful.
The documentation does not specify which exact ERC20 tokens will be used, so this leads to the opportunity of using tokens that do not revert in case of failure and return false.

Impact

Funds could remain locked, uncertainness of the funds transfer status

Tools Used

Manual Review, Slither

Recommendations

Consider one of the following approaches

• Validate the returned result:

• Track which transfer failed and for those users who for some reason cannot receive reward, let the manager take their price instead to void funds lock.