MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Users can claim their rewards after the claim period has ends

arinthal

Summary

Users can claim their rewards after the 90-day claim period ends, until the contest is closed by the admin.

Vulnerability Details

The Pot::claimCut function allows users to claim their rewards. According to the documentation, users have 90 days to do so. If not all users claim their rewards within this period, the remaining pool will be redistributed between the admin and the users who have already claimed their rewards. However, the issue is that users can still claim rewards after the 90-day period, up until the contest is closed by the admin.

Impact

The claiming period requirement could be broken.

Proof of Concepts

The user calls the Pot::claimCut function after the 90-day period has ended and successfully claims their reward.

Proof of code

Add the following code to the TestMyCut.t.sol file within the TestMyCut contract.

function testClaimAfterClaimPeriodEnded() public mintAndApproveTokens {
vm.startPrank(user);
contest = ContestManager(conMan).createContest(players, rewards, IERC20(ERC20Mock(weth)), 4);
ContestManager(conMan).fundContest(0);
vm.stopPrank();
​
// moving the timestamp 90 days + 1 second forward
vm.warp(block.timestamp + 90 days + 1);
​
uint256 playerClaimedRewardBeforeClaim = ERC20Mock(weth).balanceOf(player1);
uint256 playerCutBeforeClaim = Pot(contest).checkCut(player1);
​
assertEq(playerCutBeforeClaim, 3);
assertEq(playerClaimedRewardBeforeClaim, 0);
​
vm.prank(player1);
// claim after the designated period
Pot(contest).claimCut();
​
uint256 playerClaimedRewardAfterClaim = ERC20Mock(weth).balanceOf(player1);
uint256 playerCutAfterClaim = Pot(contest).checkCut(player1);
​
assertEq(playerCutAfterClaim, 0);
assertEq(playerClaimedRewardAfterClaim, 3);
}

Tools Used

  • Manual Review

  • Foundry

Recommended Mitigation

The Pot::claimCut function should check that the claim period is still active and then process the claim.

Possible solution (changes in Pot.sol file):

+ error Pot__ClaimPeriodHasEnded();
function claimCut() public {
address player = msg.sender;
uint256 reward = playersToRewards[player];
+ if (block.timestamp > i_deployedAt + 90 days) {
+ revert Pot__ClaimPeriodHasEnded();
+ }
if (reward <= 0) {
revert Pot__RewardNotFound();
}
playersToRewards[player] = 0;
remainingRewards -= reward;
claimants.push(player);
_transferReward(player, reward);
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.