MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

The `claimantCut` is calculated incorrectly

vasquez

Summary

The reward for the claimants after the close of the pot is calculated incorrectly.

Vulnerability Details

https://github.com/Cyfrin/2024-08-MyCut/blob/946231db0fe717039429a11706717be568d03b54/src/Pot.sol#L57

The closePot::Pot.sol function has to distribute the remainingRewards (after sending the managerCut to the ContestManager contract) to the users that already claimed their rewards a.k.a the Claimants. The formula for executing this action isn't correct:

uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;

The amount left as remainingRewards is divided by the i_players.lenght array, which is the array with all of the players that could get their rewards in the 90 days period. Eligible for this claimantCut are only the players that have claimed their reward, so the total amount of awards left should be divided by the length of the claimants array.

Impact

The closePot function could endup reverting due to insufficient amount of token in the contract or a small amount of token could be distributed and the leftovers could endup locked forever in the contract -> leading to a smaller reward for the claimants.

Tools Used

Manual Review

Recommendations

Change the formula for calculating the claimantCut.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+ uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
​
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.