MyCut

Summary

The Pot contract includes logic to map players to rewards during its initialization. However, it lacks validation to ensure that each player in the players array is unique. This oversight can lead to incorrect reward allocations, as duplicate addresses may result in the overwriting of rewards.

Vulnerability Details

players and rewards arrays are used to map player addresses to their corresponding rewards in the constructor. Currently, there is no check to ensure that each address in the players array is unique. Without such a check, duplicate addresses can easily go unnoticed, leading to incorrect mappings in the playersToRewards mapping.

Impact

Duplicate entries in the players array can lead to incorrect reward allocations. The affected player might receive a reward amount that differs from the original intent, which can result in disputes or dissatisfaction among participants.
Malicious users could exploit this by intentionally submitting duplicate addresses to manipulate the reward distribution, potentially siphoning rewards meant for others.

Tools Used

Manual Review

Recommendation

Add a check within the constructor to ensure that each address in the players array is unique.