MyCut

Description:

The Pot contract features an unbounded loop in the closePot function, which poses a significant risk of causing a Denial Of Service (DOS) attack.

The unbounded nature of this loop introduces a risk where an unexpected surge of claimants could cause the contract to fail or execute critical functions.

Impact:

Function Execution Failure: In the closePot function, a large claimants array may result in the function failing to execute due to running out of gas. This failure could leave the pot open indefinitely, preventing the distribution of rewards and locking funds within the contract. This would disrupt the intended functionality and could lead to significant financial losses for users and the protocol.

Proof of Concept:

Unbounded Loop in closePot Function:

• Simulate the scenario where a large number of claimants (e.g., 5,000 or more) have participated.

• Call the closePot function.

• Observe that the function fails to execute due to running out of gas, preventing the distribution of the remaining rewards.

Recommended Mitigation:

Redesign the reward distribution process to avoid large loops altogether. Consider implementing a pull-based model where each claimant independently claims their reward without relying on the closePot function to distribute rewards.