MyCut

Description

The Pot::closePot function is designed to distribute the remaining rewards of a pot once it is closed. However, the function contains a vulnerability related to how the remaining rewards are distributed among the claimants. Specifically, the implementation incorrectly calculates the share (claimantCut) of the remaining rewards that should go to each claimant who claimed in time.

According to the contest documentation, the remaining rewards should be distributed equally among authorized claimants who claimed in time. However, the current implementation of Pot::closePot incorrectly calculates each claimant's cut using:

This line erroneously divides the remaining rewards after manager cut by the number of all players (i_players.length) instead of the number of authorized claimants (claimants.length). As a result, the amount transferred to each claimant may not align with the intended distribution, leading to an incorrect allocation of rewards.

Impact

Authorized claimants may experience financial loss due to the incorrect reward calculation, leading to potential disputes and loss of trust in the contract.

Tools Used

Manual review, vscode

Recommended Mitigation

To ensure that the rewards are distributed correctly according to the contest's requirements, the calculation of claimantCut in Pot::closePot should be modified to correctly divide the remaining rewards by the number of authorized claimants (claimants.length). The corrected code snippet is as follows: