MyCut

Summary

The ContestManager contract receives the tokens from the Pot contract when the Pot::closePot() function is called, as the ContestManager contract creates the Pot contract and thus, is the owner of that contract, not the deployer of ContestManager.

Vulnerability Details

When the funds are transferred to msg.sender in Pot::closePot(), they are transferred to the ContestManager contract address, and not the owner of ContestManager. Since there is no method to withdraw funds from the contract, the tokens are lost forever.

Impact

Tokens are lost forever as there is no way to withdraw them from the ContestManager contract.

Tools Used

Manual Review

Recommendations

Pass the owner as an address value when creating Pot contract to set the owner of ContestManager as the owner of Pot contract as well, and then transfer the funds to the owner address, instead of msg.sender.
Or you could just transfer the tokens to tx.origin instead of msg.sender.