MyCut

Summary

The Pot contract incorrectly initializes the Ownable parent contract in the inheritance declaration instead of the constructor, which is a wrong statement.

Vulnerability Details

In the Pot contract, the Ownable parent contract is incorrectly initialized in the inheritance declaration:

This syntax is not supported in Solidity and does not correctly initialize the Ownable contract. Although in this specific case, since the Pot contract is always deployed by the ContestManager contract, the msg.sender at deployment will indeed be the ContestManager, meaning that the ContestManager becomes the owner of the Pot contract. Thus, the core functionality remains intact.

Impact

• Confusion and Misinterpretation: The incorrect syntax could lead to confusion and incorrect assumptions about the contract’s ownership and security model.

• Potential Introduction of Errors: Future changes or refactoring might introduce errors if developers assume this pattern is valid and reuse it incorrectly.

Tools Used

Manual Review

Recommendations

The Ownable contract should be correctly initialized in the constructor of the Pot contract. Even though the msg.sender in this context is correctly set to the ContestManager, the proper syntax ensures clarity and maintains code quality: