MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect cut calculation on pot closing leads to locking part of the funds in the Pot contract

al88nsk

Summary

Function Pot::closePot incorrectly calculates cut that must be paid to claimants and taht leads to part of the funds are locked in the Pot contract after the pot is closed.

Vulnerability Details

Function Pot::closePot transfers the manager's cut and then distributes remaining rewards between players who claimed their cut in time:

if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}

The issue here is that claimant's cut is calculated as (remainingRewards - managerCut) / i_players.length, but it must be (remainingRewards - managerCut) / claimants.length. If some players have not claimed their cut, the claimants count is less then i_players.length (overall players count), and the calculated cut will be smaller than it must be.

Impact

Part of the funds will be locked in the Pot contract after closing if some players do not claim their rewards in time.

Tools Used

Manual review

Recommendations

Change claimant cut calculation as below:

-uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.