MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

wrong logic used for claimantCut in Pot::closePot

cryptedoji

Summary

based on the design of the protocol, after claim period has ended and the manager has taken her cut, the remainingCut in the Pot should be shared amongst the claimants and NOT the players; hence using the logic uint256 claimantCut = (remainingRewards - managerCut) / i_players.length; in Pot::closePot is wrong and results in distributing to users who do not meet up with the criteria for distribution.

Vulnerability Details

based on the docs, it states that ...the manager takes a cut of the remaining pool and the remainder is distributed equally to those who claimed in time!, therefore using i_players.length is wrong

PoC

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
@> uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

Impact

  • distribution of remaing reward to non qualified users

Tools Used

  • manual review

Recommendations

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+ uint256 claimantCut = (remainingRewards - managerCut) /claimants.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.