MyCut

Summary

In the claimCut() function of the Pot contract, there is no enforcement of the 90-day claim period for players to claim their rewards. The function allows players to claim their rewards indefinitely, even after the claim period has expired, which violates the protocol's intended behavior.

Vulnerability Details

The claimCut() function is missing a check to verify whether the 90-day claim period has passed. According to the protocol description, players are only allowed to claim their rewards within 90 days. Once this period has passed, the manager should be able to close the pot, take a cut, and redistribute the remaining rewards to the eligible claimants. However, the current implementation does not prevent players from claiming their rewards after the claim period has expired.

Here’s the relevant portion of the code:

Impact

The lack of a time-bound check can lead to the following issues:

1. Unauthorized Claims Post-Expiration: Players can claim their rewards even after the 90-day claim period has elapsed, which goes against the protocol's intended behavior. This may cause conflicts, especially when the manager attempts to close the pot and redistribute the remaining rewards to claimants.

2. Potential Manager Exploitation: If a player claims rewards after the claim period has ended, the pool’s remaining rewards calculation that is done in Pot::closePot() can be affected. This may cause inaccurate reward distributions when the manager attempts to take their cut and redistribute the rewards to claimants.

Tools Used

Manual Review

Recommendations

Add a new error:

Update the claimCut() function to include the claim period check: