MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

High-ContestManager loss the refund function which make the managerCut can't be refund

lilizhu

Summary

ContestManager loss the refund function which make the managerCut can't be refund.

Vulnerability Details

when contestManager call closeContest function, the managerCutPercent of the remainingReward in the Pot will be transfer to contestMananger contract, But contestManager doesn't has the refund function, which make the erc20 be locked in the contestManager contract.

In Pot.sol(https://github.com/Cyfrin/2024-08-MyCut/blob/946231db0fe717039429a11706717be568d03b54/src/Pot.sol#L53C8-L55C54), closePot() the 10% of the remaingRewards was the managerCut and is transfered to the contestManager.

if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​

Impact

the erc20 token is locked in the ContestManager

Tools Used

manual

Recommendations

add the refund function in ContestManager.sol

function reFund(IERC20 token) public onlyOwner {
token.transfer(msg.sender, token.balanceOf(address(this)));
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Owner's cut is stuck in ContestManager

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.