Submission Details
Severity:
Improper remaining funds distribution when we close the pot
Summary
When we close one pot, the remaining rewards will be distributed to all claimants. The claimantCut calculation is incorrect. This will cause some funds may be locked in pot.
Vulnerability Details
When we close one pot, we will check whether they are some remaining rewards. The remaining rewards will be distributed to the claimants.
The claimantCut calculation is incorrect. The actual claimant count should be claimants.length, not i_players.length.
function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
// @audit-ok manager cut will be transferred to the contest manager. Funds will be locked in contest manager.
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
@> uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
Impact
Some funds may be locked in pot.
Tools Used
Manual
Recommendations
In the claimantCut calculation, we should divide claimants.length instead of i_players.length.
Updates
Lead Judging Commences
equious about 1 year ago
Submission Judgement Published Assigned finding tags:
Incorrect distribution in closePot()
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.