Summary

Reward calculation in Pot::closePot function does not follow its specs.

Vulnerability Details

The specs for the `Pot::closePot` is as follow: "...the manager takes a cut of the remaining pool and the remainder is distributed equally to those who claimed in time! "

This mean unclaimed reward will be shared with manager and who has claimed.

But in the https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/Pot.sol#L57, the remaining reward after manager take the cut, is shared to all players, includes who has not claimed yet.

Impact

• players has claimed will get less reward then they should

• players has not claimed will get the same reward as who has claimed (expected they get nothing)

Tools Used

Manual review

Recommendations

Divide the remaining reward to to the number of user who has claimed.