MyCut

Summary

claimCut()::Pot.sol doesn't check if the 90 days restriction period has passed.

Vulnerability Details

Because of a lack of check for the 90 days restriction period, a user can claim without the cut, after the 90 days if closePot() has not been executed before.

https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/Pot.sol#L37-L47

POC (Proof Of Concept)

=> Change the timestamp at time of deploymant + 95 days (to be over the 90 days restriction period)

=> Do not execute closePot()

=> Execute claimCut()and check that the transaction do not revert and that you get the full amount without cut.

Impact

A user can bypass the 90 days restriction, meaning bypassing the main rule of the protocol.

Tools Used

Github, VisualCode, Foundry.

Recommendations

You should add a check for the 90 days, and revert if the 90 days window has passed :

Impact

A user can bypass the 90 days restriction, meaning bypassing the main rule of the protocol.

Tools Used

Github, VisualCode, Foundry.

Recommendations

You should add a check for the 90 days, and revert if the 90 days window has passed :