MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Calculation in Pot which leads to incorrect fund distribution

dharmin

Description: In Pot::closePot(), the claimantCut, we are dividing the remaining rewards by the number of players to distribute the rewards. However, we are dividing the remaining rewards by the number of players instead of number of claimants. This will lead to incorrect fund distribution.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
console.log("remainingRewards: %d", remainingRewards);
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
@> uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

Impact: This will lead to incorrect fund distribution and may result in a loss of funds for the claimants. Every claimant will receive a lesser amount than they should have received, and some amount will be left in the contract at the end of the distribution.

Proof of Concepts:

If we have 1000 players and 900 claimants and the remaining rewards are 1000, the manager cut is 100, and the claimant cut will be should be 900 / 900 = 1. But according to the current implementation, the claimants will receive 900/1000 = 0.9, which is incorrect.

Recommended mitigation: The claimantCut should be calculated by dividing the remaining rewards by the number of claimants instead of the number of players. This will ensure that the rewards are distributed correctly among the claimants.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
console.log("remainingRewards: %d", remainingRewards);
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+ uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.