MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect `claimantCut` calculation in reward distribution

cryptolappi

Summary

The Pot contract contains a bug in the closePot() function where the remaining rewards are divided by the total number of players (i_players.length) instead of the number of claimants (claimants.length). This leads to an incorrect calculation of the additional reward distribution after the 90-day claim period and violates the intended protocol behavior.

Vulnerability Details

According to the protocol description:

MyCut is a contest rewards distribution protocol which allows the set up and management of multiple rewards distributions, allowing authorized claimants 90 days to claim before the manager takes a cut of the remaining pool and the remainder is distributed equally to those who claimed in time!

However, in the closePot() function, the following line calculates the individual cut for each claimant:

uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;

This calculation uses i_players.length, which represents all players, instead of claimants.length, which should represent "those who claimed in time". This discrepancy means the current implementation does not fulfill the protocol's stated behavior of distributing the remainder "equally to those who claimed in time".

Impact

The impact of this vulnerability includes:

  1. Incorrect reward distribution: Claimants receive less additional reward than intended if not all players claimed within 90 days.

  2. Potential fund lock: If i_players.length > claimants.length, some funds may remain locked in the contract.

  3. Violation of protocol rules: The distribution does not follow the stated rule of equal distribution among timely claimants.

  4. Broken user expectations: Users expecting the behavior described in the protocol description will find the actual distribution doesn't match what was promised.

Tools Used

Manual code review.

AI for report text and formatting.

Recommendations

To address this vulnerability and align with the intended protocol behavior as described in the documentation, implement the following change:

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+ uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

By implementing this recommendation, you ensure that the remaining rewards are distributed equally among those who claimed in time, aligning with the intended protocol behavior as described in the protocol documentation.

Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.