MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

If none of the players claim the reward then 90% of the rewards will be stuck in the contract

hawksvision

Summary

If none of the players claim any reward from the pot then around 90 percent of the total reward tokens will be stuck in the contract.

Vulnerability Details

The closePot() function first checks for the time elapsed and then it sends 10% of the unclaimed rewards to the manager and the remaining is split between the players who have claimed the rewards.This function didn't have a logic to deal with the tokens when none of the players have claimed the tokens,thus leaving the remaining 90% of the tokens to be locked in the contract itself.

Impact

It will lead to loss of 90% of the reward tokens when no player claims the reward.

Proof Of Concept

function testUnclaimedRewardDistribution() public mintAndApproveTokens {
vm.startPrank(user);
rewards = [500, 500];
totalRewards = 1000;
contest = ContestManager(conMan).createContest(players, rewards, IERC20(ERC20Mock(weth)), totalRewards);
ContestManager(conMan).fundContest(0);
vm.stopPrank();
​
vm.warp(91 days);
​
vm.startPrank(user);
ContestManager(conMan).closeContest(contest);
vm.stopPrank();
assertEq(ERC20Mock(weth).balanceOf(contest) > 0);
}

Tools Used

->Foundry

-> Manual review

Recommendations

Add a case for what to do when none of the users have claimed the rewards similar to the code below

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (claimants.length == 0)
{
i_token.transfer(msg.sender, remainingRewards);
remainingRewards = 0;
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
Updates

Lead Judging Commences

equious Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect handling of zero claimant edge case

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.