MyCut

Summary

The ContestManager and Pot smart contracts contain a vulnerability where funds can be frozen or lost if a pot is funded after it has been closed. This issue arises from the lack of checks to prevent funding closed pots and the absence of a mechanism to recover unused funds.

Vulnerability Details

Funding Closed Pots: The ContestManager allows funding of pots without checking if they are closed, which can lock funds in the contract.

No Withdrawal Mechanism: After a pot is closed, there is no way for the manager to withdraw any remaining funds, leading to potential loss.

Impact

Frozen Funds: New funds sent to a closed pot may become inaccessible.

Loss of Funds: Without a withdrawal function, any remaining funds in a closed pot could be permanently lost.

Recommendations

Add checks in ContestManager to ensure pots are open before funding.