MyCut

Summary

A vulnerability has been identified in the smart contract's calculation of the manager's cut from remaining rewards. The current implementation using integer division can result in the manager receiving no cut or a significantly undervalued cut, especially for smaller reward amounts.

Relevant code

https://github.com/Cyfrin/2024-08-MyCut/blob/946231db0fe717039429a11706717be568d03b54/src/Pot.sol#L53-L55

Vulnerability Details

The vulnerability is present in the following line of code:

uint256 managerCut = remainingRewards / managerCutPercent;

Where managerCutPercent is a constant set to 10.

The issue arises due to Solidity's integer division, which truncates any fractional results. This leads to several problems:

1. For any remainingRewards less than 10, managerCut will always be 0.

2. The calculation lacks precision for values not divisible by 10.

3. There's a sudden jump from 0 to 1 at the threshold of 10 remaining rewards.

Impact

The manager faces potential financial loss, particularly with smaller reward pools, as they may receive no cut or a substantially reduced amount. This inaccurate distribution not only deviates from the contract's intended 10% allocation but also undermines the fairness of the reward system.

POC

Here's a simple POC to demonstrate the issue:

Tools Used

Manual review

Recommendations

I recommend implementing a scaled calculation approach to address this vulnerability. This method will preserve precision.