MyCut

Summary

In the MyCut rewards distribution protocol, the closePot() function is called through the closeContest() function in the ContestManager contract. The manager's cut of the remaining rewards pool is transferred to the msg.sender of the closePot() function, which is the ContestManager contract itself, not the actual manager. This creates a scenario where the manager’s cut becomes stuck in the ContestManager contract, as there is no mechanism in place to withdraw the funds from this contract.

Vulnerability Details

When the closePot() function is executed, it calculates the manager's cut from the remaining funds in the rewards pool. The function then attempts to transfer these funds to msg.sender, which is the address calling the function. However, the closeContest() function from the ContestManager contract is the one that calls closePot(), making the ContestManager contract the msg.sender in this context.

Since the ContestManager contract does not have any functionality to withdraw or transfer funds, the manager’s cut remains stuck in this contract with no way to recover the funds.

Impact

Stuck Funds: The manager's cut, which is intended to reward the manager for managing the contest, will remain locked in the ContestManager contract.

Tools Used

Manual Review

Recommendations

Update the Transfer Logic: Instead of transferring the manager's cut to msg.sender, the protocol should explicitly transfer the funds to the manager’s address (which could be passed in as a parameter or stored in the contract upon contest creation).