MyCut

Summary

The contracts ContestManager and Pot fail to validate that the players and rewards arrays have the same length when creating a new contest. This oversight can lead to various issues including unfair reward distribution, potential out-of-bounds access, and inconsistencies in the contract's state.

Vulnerability Details

The vulnerability is present in two key areas:

1. ContestManager.sol:

   function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)

   public

   onlyOwner

   returns (address)

   {

   Pot pot = new Pot(players, rewards, token, totalRewards);

   // ...

   }

   This function does not check if players.length == rewards.length before creating a new Pot.

2. Pot.sol:

   constructor(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) {

   // ...

   for (uint256 i = 0; i < i_players.length; i++) {

   playersToRewards[i_players[i]] = i_rewards[i];

   }

   }

   The constructor assumes that players and rewards have the same length without verification.

If the lengths of these arrays don't match, it can lead to:

• Unassigned rewards if players.length > rewards.length

• Potential out-of-bounds access if rewards.length > players.length

• Incorrect calculation of total rewards

Impact

The impact of this vulnerability is severe:

1. Fairness: Some players may not receive rewards or receive incorrect amounts, compromising the fairness of the contest.

2. Financial Loss: Mismatched array lengths could lead to unintended fund distribution or locked funds in the contract.

3. Contract Integrity: The contract's state may become inconsistent, affecting operations like claiming rewards or closing the pot.

4. Security: Out-of-bounds array access could potentially be exploited for malicious purposes.

Tools Used

Manual code review.

AI for report text and formatting.

Recommendations

To address this vulnerability, we recommend the following:

1. Implement length checks in ContestManager.createContest():

   require(players.length == rewards.length, "Players and rewards arrays must have the same length");

2. Add similar checks in the Pot constructor:

   require(players.length == rewards.length, "Players and rewards arrays must have the same length");

By implementing these recommendations, the contract will be more robust against potential misuse and errors related to array size mismatches.