MyCut

Summary

In the `closePot` function, if the number of claimants is zero, the remaining rewards intended for distribution among claimants may not be properly reclaimed by the Contest Manager. The `claimantCut` is calculated using the length of the `i_players` array instead of the `claimants` array, which could lead to incorrect distribution. Additionally, the function does not have a mechanism to handle the scenario where there are zero claimants, resulting in the potential loss of rewards.

Vulnerability Details

Specifically, when there are no claimants:

• The manager's cut is calculated but only a portion or none of the remaining rewards is transferred back to the Contest Manager.

• The rewards intended for claimants (`claimantCut`) are not distributed because the loop iterating over `claimants` does not execute, but there's also no fallback to reclaim these rewards.

Proof of Concept

Add this test in the TestMyCut.t.sol:

In the test testClosePotWithZeroClaimants, after closing a pot with zero claimants, the Contest Manager is unable to reclaim all the remaining rewards:

Impact

• This bug can lead to incomplete recovery of rewards by the Contest Manager. If no participants claim their rewards, a significant portion of the remaining tokens could remain locked in the contract indefinitely, leading to financial loss and inefficient fund management.

• And All the reward is lost except from the little 10 % the manager gets because there was no mechanism to claim the remainingReward

Tools Used

• Foundry Testing

Recommendations

• Adjust Calculation Logic: Modify the `claimantCut` calculation to divide by `claimants.length` instead of `i_players.length`. This ensures that only the claimants are considered when distributing the remaining rewards.

• Handle Zero Claimants: Implement a check to determine if there are zero claimants. If true, all remaining rewards should be transferred back to the Contest Manager to ensure no tokens are left stranded in the contract.

  Example

  if (claimants.length == 0) {

  i_token.transfer(msg.sender, remainingRewards);

  } else {

  for (uint256 i = 0; i < claimants.length; i++) {

  _transferReward(claimants[i], claimantCut);

  }

  }

This approach ensures that in the event of zero claimants, all remaining rewards are securely returned to the Contest Manager.