MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

In closePot()::Pot.sol, remainingRewards is not updated.

0xziin

Summary

In closePot()::Pot.sol, remainingRewards is not updated.

Vulnerability Details

In closePot()::Pot.sol :

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
}

https://github.com/Cyfrin/2024-08-MyCut/blob/main/src/Pot.sol#L49-L62

remainingRewardsis unchanged after the execution of the function.

=> It should be updated before the end of the closePot() function, because if not, the remainingRewards will still be at the initial value even if there is no remainingRewards left in the contract, misleading the end user if the front end of the dapp retrieves the value of this remainingRewards variable.

Impact

Misleading of the end user if he uses the remainingRewards variable in his interaction with the protocol.

Tools Used

Github, VisualCode.

Recommendations

Update the value of remainingRewards before the end of the closePot()::Pot.solfunction, like follow :

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
remainingRewards = 0; // <== Update of the remaingRewards value
}
}
Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.