MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Manager cut & claimants logic is flawed

whizz1

Summary

The closePot() function in the Pot contract has flawed logic for calculating the manager's 10% cut and distributing rewards among claimants.

Vulnerability Details

  1. The manager is supposed to receive 10% of the pot, but the calculation is incorrect.

  2. Claimants receive less than they are entitled to, as rewards are divided based on the total number of players instead of just the claimants.

Impact

Financial Loss for the Manager: The manager might receive less than the intended 10%, resulting in financial loss for the person managing the contract.
Underpayment to Claimants: Since claimants may be fewer than all players, eligible claimants receive less than they should.

Tools Used

Unit test

Recommendations

if (remainingRewards > 0) {
// +++ Calculate the manager's cut (10% of remaining rewards)
uint256 managerCut = (remainingRewards * 10) / 100;
i_token.transfer(msg.sender, managerCut);
​
//+++ Calculate the amount to be distributed among the claimants
uint256 remainingAfterManagerCut = remainingRewards - managerCut;
​
// Ensure there are claimants before attempting to distribute rewards
if (claimants.length > 0) {
//++++ Calculate the amount each claimant should receive
uint256 claimantCut = remainingAfterManagerCut /
claimants.length;
// Distribute the claimant's share to each claimant
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
​
//++ After distribution, update the remaining rewards to 0
remainingRewards = 0;
}
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Erroneous ManagerCut calculation

Appeal created

equious Lead Judge
12 months ago
equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.