Submission Details
Severity:
Incorrect calculation of `claimantCut` amount in the `closePot::Pot.sol`, leads to inaccurate reward distribution.
Description The claimantCut is the amount of tokens, that is distributed equally to claimants as an incentive for their timely claims.
It is calculated by dividing the remainingRewards-managerCut amount with the i_players.length which is incorrect.
Impact Less tokens transfered to the timely claimants of what they were supposed to receive.
Proof Of Concept
players = [player1,player2]
rewards = [3e18,1e18]
token = weth
totalRewards = 4e18
Place the following code in TestMyCut.t.sol:
function test_IncorrectclaimantCut()public{
vm.startPrank(user);
weth.mint(user,1000e18);
address pot = ContestManager(conMan).createContest(players,rewards,weth,totalRewards);
weth.approve(conMan,type(uint256).max);
ContestManager(conMan).fundContest(0);
vm.stopPrank();
// player1 claims reward before 90 days, in time!
vm.prank(player1);
Pot(pot).claimCut();
vm.warp(block.timestamp + 90 days);
vm.roll(block.number + 1);
// the ContestManager closes the pot
vm.prank(user);
ContestManager(conMan).closeContest(pot);
console.log("player1's cut after closePot :",Pot(pot).getToken().balanceOf(player1));
assertEq((Pot(pot).getToken()).balanceOf(player1),3.45e18);
// balance of tokens still left in the pot
console.log("remaining rewards in the pot after closePot :",Pot(pot).getToken().balanceOf(pot));
}
Recommended Mitigation
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
+ uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
Updates
Lead Judging Commences
equious about 1 year ago
Submission Judgement Published Assigned finding tags:
Incorrect distribution in closePot()
Rewards breakdown
nSLOC
106This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.