MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unmatched business logic between the documentation and code in `Pot::closePot()`

hrmneffdii

Summary

In Pot::closePot function, there is a missmatch logic between the documentation and the code. This causes the players who claimed early to receive fewer rewards than expected.

Vulnerability Details

Let's quote any explanation from documentation :

MyCut is a contest rewards distribution protocol which allows the set up and management of multiple rewards distributions, allowing authorized claimants 90 days to claim before the manager takes a cut of the remaining pool and the remainder is distributed equally to those who claimed in time!

If we are careful when reading the documentation, we will see that the remaining rewards, after being taken by managerContest, are distributed equally among the players who claimed. This means it's only the players who claimed, not all users. Let's see the code base in Pot::closePot :

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
@> uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

In the above,it's clear that the remaining rewards are divided by among all players i_players. This is a problem because according to the documentation, it should be divided among the claimants.

Impact

The players who claimed in time received fewer a rewards than expected

Tools Used

Manual review

Recommendations

Maybe we can change the i_players with claimants :

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
- uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
+ uint256 claimantCut = (remainingRewards - managerCut) / claimants.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}
Updates

Lead Judging Commences

equious Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect distribution in closePot()

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.