MyCut

Summary

In the MyCut rewards distribution protocol, after the owner calls the closePot() function, the remaining funds are distributed between users who initially claimed their rewards. However, there is a critical issue in the logic for calculating the distribution amount. The protocol divides the remaining funds by the total number of eligible players (the length of the players array), rather than dividing it by the number of users who initially claimed their rewards. This leads to a scenario where part of the remaining funds becomes stuck in the contract, as it is incorrectly calculated.

Vulnerability Details

When the closePot() function is called on Day 90, the protocol calculates the remaining funds after the manager takes their cut. These remaining funds are supposed to be distributed equally among the users who initially claimed their rewards within the specified 90-day window.

However, the calculation is based on the total number of eligible players (length of the players array), not on the number of users who have actually claimed their rewards. Since some users may not have claimed their rewards, dividing the remaining funds by the total number of players will leave some portion of the funds undistributed and stuck in the contract.

https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/Pot.sol#L49

Impact

Stuck Funds: A portion of the remaining funds that should be distributed among the users who claimed their rewards will get stuck in the contract.

Tools Used

Manual Review

Recommendations

Update the distribution logic in the closePot() function to divide the remaining funds only by the number of users who have actually claimed their rewards, rather than by the total number of eligible players.