MyCut

Summary

anyone can be added to the players array, multiple times including the contract owner. rewards can have different amounts / values making the contest fixed.

Vulnerability Details

if Player1 was added into the array 2 times with 2 different reward amounts Player1 Reward=100 and Player1 Reward =10. The reward enter last (being 10) in the array will be transferred, not combined value of Reward=110 or the larger amount of 100. This amount will still be counted as a reward, leaving funds unclaimable and inside the contract.

the contract owner can also be a player and receive a cut after closing the pot.

rewards can be unevenly distributed.

Impact

loss of funds

Tools Used

forge.

Recommendations

use a mapping for accounting and a set reward %.