MyCut

Summary

In the closePot() function of the Pot contract, the rewards for claimants are incorrectly divided by i_players.length (total players) instead of claimants.length (players who actually claimed). This results in an unfair distribution of the remaining rewards, as the amount calculated per claimant is based on the total number of players, not just those who are eligible to receive rewards.

Vulnerability Details

In the closePot() function, the rewards for claimants are calculated as follows:

This line divides the remaining rewards (after the manager's cut) by the total number of players (i_players.length). However, according protocol documentation, the rewards should be distributed only among the players who actually claimed their rewards, i.e., the length of the claimants array.

For example, if there are 10 total players (i_players.length = 10), but only 5 of them have claimed rewards (claimants.length = 5), the current logic would incorrectly calculate each claimant's cut based on all 10 players, resulting in each receiving less than they are entitled to.

Impact:

1. Unfair Distribution of Rewards: The claimants receive a smaller share than they should, as the remaining rewards are divided among all players instead of just those who claimed.

2. Underpayment to Eligible Claimants: Claimants may be underpaid since the remaining rewards are incorrectly spread across a larger group, reducing the individual amount for those who are eligible.

Steps to Reproduce the Issue:

1. Step 1: Deploy the Pot contract with 10 players and a rewards pool.

2. Step 2: Let only 5 players claim their rewards.

3. Step 3: Call the closePot() function after the 90-day claim period.

4. Expected Outcome: The remaining rewards should be distributed among the 5 claimants.

5. Actual Outcome: The rewards are divided by 10 (the total number of players), reducing each claimant’s share.

   For example:

   • Initial setup:

     • remainingRewards = 1000

     • i_players.length = 10

     • claimants.length = 5

   • Expected claimant cut: (1000 - managerCut) / 5

   • Actual claimant cut: (1000 - managerCut) / 10

Tools Used

Manual Review

Recommendations

To fix this issue, modify the following line:

to:

This change ensures that the remaining rewards are fairly distributed among the players who actually claimed their rewards, preventing underpayment and ensuring the correct protocol behavior.