MyCut

Description USDC maintains a blacklist of addresses. If an address is blacklisted, any transfer to or from that address will revert the entire transaction.

If any claimant's address becomes blacklisted after the pot is created but before closePot is called, the entire closePot function will revert when it tries to transfer to that address.
This creates a potential Denial of Service vulnerability, as it could prevent the pot from ever being closed if even one address is blacklisted.

Impact Tokens will be locked in the pot, and neither the manager nor other claimants will ever be able to claim their extra incentives.

Recommended Mitigation

1. Introduce a separate claimReward function that players can call individually to claim their rewards after the pot is closed.

2. Add a claimManagerCut function for the owner to claim their cut separately.