MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

If there are no claimants, 90% of the reward will remain locked

elprofesor

Summary

After 90 days have passed, the user who created the contest, by calling the ContestManager::closeContest function, closes the contest and if someone has not taken the reward, takes 10% of the remaining value, and the rest is divided equally among the claimants.The issue is that if no one claims the reward, the user will recover 10% of the reward, while 90% of the reward will remain locked. This is because the current implementation does not account for the possibility that the number of claimants could be zero.

Vulnerability Details

The vulnerability is located in the Pot::closePot function, which is called from the ContestManager::_closeContest function, which is then called from the ContestManager::closeContest function.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
@> uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
@> uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

Here we see that, when closing the contest, there is no check for the possibility of having zero claimants.

Impact

90% of the reward will remain locked.

Tools Used

Manual Code Review, Foundry Test

Recommendations

Consider the scenario where the number of claimants is zero. One possible code fix could be the following:

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
​
if (remainingRewards > 0) {
+ if(claimants.length == 0){
+ i_token.transfer(msg.sender, remainingRewards);
+ }
+ else{
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);}
}
}
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect handling of zero claimant edge case

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.