MyCut

Description:

The claimCut function does not include a mechanism to prevent players from claiming their rewards more than once. While the function sets the player's reward to zero after a claim, it does not explicitly check if the player has already claimed their reward before allowing the operation. This omission could lead to scenarios where a player could attempt to claim their reward multiple times before the state is fully updated.

https://github.com/Cyfrin/2024-08-MyCut/blob/946231db0fe717039429a11706717be568d03b54/src/Pot.sol#L37-L51

Impact:

Allowing players to claim rewards multiple times could lead to double dipping, where a player unfairly receives more than their allocated reward. This behavior could deplete the remaining rewards, reducing the total available to other players or disrupting the intended distribution of funds. In a worst-case scenario, it could lead to an uneven distribution of rewards and potential financial loss to the system.

Proof of Concept:

1. Deploy the contract and allocate rewards to several players.

2. A player claims their reward using the claimCut function.

3. Without any checks, the player attempts to call claimCut again.

4. Observe that the function allows the player to initiate a claim, potentially leading to unexpected behavior and state inconsistencies.

Recommended Mitigation:

Add a check at the beginning of the claimCut function to ensure that a player cannot claim their reward more than once. This can be achieved by verifying that the player’s reward is greater than zero before proceeding with the claim:

Example Fix:

This mitigation ensures that each player can only claim their reward once, preventing multiple claims and maintaining the integrity of the reward distribution process.