MyCut

Summary

The Pot smart contract’s constructor fails to validate that the lengths of the players and rewards arrays are equal. This missing validation can lead to incorrect mappings, resulting in potential vulnerabilities such as misallocation of rewards, incorrect assignment of players' rewards, and other unintended behaviors.

Vulnerability Details

Issue lies in this:

https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/Pot.sol#L22-L35

The constructor directly maps players to rewards without validating that the two arrays have the same length. If the arrays have mismatched lengths, this could lead to incorrect mappings or even runtime errors when accessing elements that do not exist. The constructor should validate that both arrays have the same length before proceeding with the mapping. This can be achieved by adding a require statement at the beginning of the constructor.

Impact

Mismatched array lengths could result in players not receiving their designated rewards or receiving incorrect amounts, leading to unfair distribution. Accessing elements of the rewards array using an index from the players array could lead to runtime errors, particularly when the lengths are mismatched.

Tools Used

Manual Review

Recommendations

Add this line in constructor:

By adding this require statement, the contract ensures that it is only deployed with valid input, preventing any potential issues related to incorrect mappings or runtime errors. This change enhances the security and reliability of the contract.