Summary

The `closePot()` function is responsible for distributing the remaining rewards between the contest manager and the claimants after the contest's closure. However, there is a critical flaw in how the claimant's cut is calculated:

Vulnerability Details

This calculation incorrectly divides the remaining rewards by `i_players.length`, which represents the total number of players, rather than by `claimants.length`, which represents the actual number of claimants who participated and are eligible to receive rewards.

Impact

• This calculation incorrectly divides the remaining rewards by `i_players.length`, which represents the total number of players, rather than by `claimants.length`, which represents the actual number of claimants who participated and are eligible to receive rewards.

• Residual Funds: Due to the division by a larger number (total players instead of actual claimants), there may be residual funds left in the contract that are not properly distributed, leading to an accumulation of unclaimed tokens.

• Potential for Disputes: Inequitable distribution of rewards could lead to dissatisfaction among the claimants and potential disputes or challenges, which could affect the contract’s reputation and trustworthiness.

Proof Of Concept

Consider a scenario where:

• `i_players.length = 10`

• `claimants.length = 2`

• `remainingReward = 100`

• `managerCut = 10`

  Given the current implementation:

  uint256 claimantCut = (remainingRewards - managerCut) / i_players.length; // (100 - 10) / 10 = 9

Each claimant would receive `9` tokens, totaling `18` tokens distributed among the `2` claimants. The remaining `72` tokens would remain in the contract, unallocated, which is incorrect.

Tools Used

Manual Review

Recommendations

To ensure that the rewards are distributed fairly among the actual claimants, modify the division logic as follows:

This approach ensures that the remaining rewards are correctly divided among the actual claimants, preventing any residual funds from being left undistributed and ensuring that each claimant receives their fair share.