MyCut

First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: medium
Valid

Zero reward withdrawals within the stipulated interval may cause tokens to be locked in the pot.

Description Case where none of the players withdraw their share of the reward within the stipulated interval,or ,no one is able to withdraw their share of the reward which is in the case of Pausable token contracts like BNB.
After 90 days the remainingRewardsstill equals the totalRewards in the pot, and the claimants array has 0 players in it.
The pot has two ways to withdraw out the tokens:

  1. One is through claimCut, which cannot be called after 90 days

  2. Second is through the closePot.

When the owner calls the closePot function, during the calculation of claimantsCut it divides the total value by 0, which results in an error causing the whole transaction to revert.
Thus tokens stay locked in the pot.

Impact Tokens might be locked in the pot forever.

Recommended Mitigation Put in an additional check which transfers the complete tokens back to the manager in case of zero withdrawals.

Updates

Lead Judging Commences

equious Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect handling of zero claimant edge case

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.