MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Manager Cut Calculation in closePot() Function

forgetfore1

Summary

In the function Pot::closePot(), the managerCut is incorrectly calculated, leading to an erroneous value when managerCutPercent != 10.

Vulnerability Details

In the function Pot::closePot(), the following formula is used to calculate the managerCut:

uint256 managerCut = remainingRewards / managerCutPercent;

This formula only works correctly when managerCutPercent = 10. However, if the manager sets managerCutPercent to a different value, the managerCut will be incorrectly calculated.

PoC (Proof of Concept)

Assume at the end of the Pot, remainingRewards = 100 and managerCutPercent = 20. The manager expects to withdraw 20% of the remaining rewards, resulting in managerCut = 20. However, using the current formula, the calculation is as follows:

managerCut = remainingRewards / managerCutPercent = 100 / 20 = 5;

This results in an incorrect withdrawal amount.

Impact

When managerCutPercent != 10, closing the Pot would result in an incorrect amount being withdrawn. This could lead to a loss of funds either for the manager (if managerCutPercent > 10) or for the players (if managerCutPercent < 10).

Tools Used

Manual review.

Recommendations

Use the correct formula for percentage calculations:

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
// @audit: manager cut is wrongly calculated even if it leads to the same result
- uint256 managerCut = remainingRewards / managerCutPercent;
+ uint256 managerCut = (remainingRewards * managerCutPercent) / 100;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.