MyCut

Summary

Information about remaining rewards is stored (which indicates that user can claim rewards) even after pot is closed and rewards are sent.

Vulnerability Details

One of the responsibilities of the metod Pot::closePot is to distribute unclaimed rewards amount users who claimed rewards. This means that all of the prize pool that the contract holds is transfered to the users and manager. However, this method does not set to zero the values for the state variables Pot::playersToRewards and Pot::remainingRewards. While not modifying them after pot is closed saves gas, it makes the methods Pot::checkCut and Pot::getRemainingRewards return values that are not 0, misleading users that there is a reward they could claim.

Impact

The methods Pot::checkCut and Pot::getRemainingRewards returns values that do not match the state of rewards that can be claimed after pot has been closed.

Tools Used

Manual review

Recommendations

Reset the values for the state variables Pot::playersToRewards and Pot::remainingRewards.