Submission Details
Severity:
Lack of access control on `Pot::claimCut`.
Description: The Pot::claimCut function allows any player to claim their reward, but there is no mechanism to prevent re-entrancy or multiple claims by the same player.
Impact: A player could potentially call claimCut multiple times if there were a re-entrancy vulnerability in the token contract, leading to multiple claims.
Recommended Mitigation: Although Solidity 0.8+ prevents re-entrancy by default, consider using a re-entrancy guard pattern or ensuring that the state is updated before any external calls:
playersToRewards[player] = 0;
remainingRewards -= reward;
_transferReward(player, reward);
claimants.push(player);
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.