Submission Details
Severity:
**[L-1] users can invoke `claimCut` prior to the contest being funded**
**Description:** It is possible that once the contest has been created, it is not necessarily funded at the same time, these are separate operations, which may result in users attempting to invoke `claimCut`, however there would be no funds and we would most likely get a `ERC20InsufficientBalance` error. Users have most probably assumed that at the time of claiming their cut that the contest is funded. The more insidious issue lies in the fact that the timer of 90 days begins when the Pot contract is constructed not when it's funded, hence if the contract is not funded at the time of creation, users will not be entitled to the whole 90 day duration claim period.
**Impact:** Bad UX, as users would be able to attempt claim their cut but this would result in a reversion.
**Proof of Concept:**
The below test can be added to `TestMyCut.t.sol:TestMyCut` contracts test suite.
**Recommended Mitigation:**
We must ensure the contest is funded at the time it is created. Otherwise we should state a clearer error message.
In the event where we want to give the users a more gracious error message, we could add the following changes which leverages a boolean to track if the Pot has been funded:
```diff
contract Pot is Ownable(msg.sender) {
/**
Existing Code...
*/
+ boolean private s_isFunded; // Ensure this is updated correctly when the contract is funded.
function claimCut() public {
+ if (!s_isFunded) {
+ revert Pot__InsufficientFunds();
+ }
address player = msg.sender;
uint256 reward = playersToRewards[player];
if (reward <= 0) {
revert Pot__RewardNotFound();
}
playersToRewards[player] = 0;
remainingRewards -= reward;
claimants.push(player);
_transferReward(player, reward);
}
}
```
In the scenario where we want to ensure the contest is funded at the time of being created employ the following code.
```diff
function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)
public
onlyOwner
returns (address)
{
// Create a new Pot contract
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
+ fundContest(contests.length - 1);
return address(pot);
}
- function fundContest(uint256 index) public onlyOwner {
+ function fundContest(uint256 index) internal onlyOwner {
Pot pot = Pot(contests[index]);
IERC20 token = pot.getToken();
uint256 totalRewards = contestToTotalRewards[address(pot)];
if (token.balanceOf(msg.sender) < totalRewards) {
revert ContestManager__InsufficientFunds();
}
token.transferFrom(msg.sender, address(pot), totalRewards);
}
```
Updates
Lead Judging Commences
equious about 1 year ago
Submission Judgement Published Assigned finding tags:
Pot funded late results in <90 days to claim.
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.