MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ManagerCut is sent to ContestManager instead of the closeContest function caller

4rdiii

[H-01] ManagerCut is sent to ContestManager instead of the closeContest function caller

Summary

The ManagerCut is sent to the ContestManager contract instead of the caller of the closeContest function. This issue arises because the Pot::closePot function transfers a portion of the remaining rewards to msg.sender, which is the ContestManager contract. However, since the ContestManager contract does not have a withdraw function and does not forward the funds to the closeContest caller, the funds are effectively lost.

Vulnerability Details

When ContestManager::closeContest is called, it invokes the Pot::closePot function. The closePot function transfers 1/managerCutPercent of the remaining rewards to msg.sender (the ContestManager contract). As the ContestManager contract does not handle these funds or forward them to the actual caller, the funds remain stuck in the contract, resulting in a loss of fees.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) /
i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
function _closeContest(address contest) internal {
Pot pot = Pot(contest);
pot.closePot();
}

Impact

Funds are trapped in the ContestManager contract, leading to a permanent loss of fees for the manager. This vulnerability affects the liquidity and proper reward distribution within the system.

Tools Used

Manual Review

Recommendations

To resolve this issue, modify the ContestManager::_closeContest function to forward the funds to the caller.

function _closeContest(address contest) internal {
Pot pot = Pot(contest);
pot.closePot();
+ IERC20 token = pot.getToken();
+ token. Transfer(msg.sender, token.balanceOf(address(this)));
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Owner's cut is stuck in ContestManager

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.