MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Funds remain locked on the ContestManager contract when taking the manager cut

elprofesor

Summary

After 90 days have passed, the user who created the contest, by calling the ContestManager::closeContest function, closes the contest and if someone has not taken the reward, takes 10% of the remaining value, and the rest is divided equally among the claimants. Namely, this 10% is not transferred to the user (the one who started the contest), but to the ContestManager contract, and thus these funds remain locked at the address of the ContestManager contract.

Vulnerability Details

ContestManager::closeContest

ContestManager::_closeContest

Pot::closePot

The vulnerability is located in the Pot::closePot function, which is called from the ContestManager::_closeContest function, which is then called from the ContestManager::closeContest function.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
@> i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

We can see here that the funds are sent to the msg.sender address, which in this case is the ContestManager contract, and not the user. This is because the Pot::closePot function is not called directly by the user, but is called through the ContestManager contract using the ContestManager::closeContest function.

Impact

The user's funds remain locked.

Tools Used

Manual code review, Foundry Test

Recommendations

Instead of the msg.sender address, pass the address of the user who created the contest to the transfer function.

Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Owner's cut is stuck in ContestManager

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.