MyCut

Summary

If there is a duplicate address or address zero in the array of players when calling createContest rewards could be sent to the wrong address or address zero

Vulnerability Details

There is no check for duplicate address when parsing players to createContest function in ContestManager.sol or in the constructor when deploying the contract.

• If an address is added twice to the array of players

• Another user's reward will get assigned to the duplicate player cuz of the duplicate address in the array.

• Leading to the user not getting a reward and/or the duplicate user receiving a reward that's not intended for them.

• Or completely lost if its address zero

Impact

Loss of funds

Tools Used

Manual

Recommendations

There should a check for duplicate addresses