MyCut

Summary

Pot::constructor() lacks validation for its input parameters. The players, rewards, and token arguments require validation because their corresponding variables do not have setter functions.

Vulnerability Details

• The token argument is missing validation against the 0x0 address.

• The players and rewards arrays are missing a length check against 0 value. Additionally, players array should be checked for the 0x0 address to ensure addresses can claim the rewards.

• The players and rewards arrays should have validation where each of the arrays have the same lenght

• The totalRewards should be cheked for the sum of the cumulative rewards in the rewards array

Impact

Mistakes during initialization of Pot can render the instancce unusable.

Tools Used

Manual review

Recommendations

It is recommended to implement comprehensive validation checks for the players, rewards, and token parameters within the Vesting::constructor() to ensure that the contract works correctly.