MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Pot can be closed multiple times

0xiceman

Summary

The closePot function in the Pot contract can be called multiple times, potentially leading to unexpected reverts due to insufficient contract balance. This is because the remainingRewards variable is not set to zero after the pot is closed, allowing for repeated distribution attempts.

Vulnerability Details

  1. The closePot function does not have a mechanism to prevent multiple calls.

  2. The remainingRewards variable is not reset to zero after distribution.

  3. Subsequent calls to closePot will attempt to distribute rewards again, potentially failing due to insufficient funds.

Impact

  1. Potential for multiple reward distributions, depleting the contract balance unexpectedly.

  2. Inconsistent state where remainingRewards is non-zero but the actual balance is zero.

Tools Used

Manual code review

Recommendations

  1. Implement a boolean flag isPotClosed to prevent multiple calls to closePot:

bool private isPotClosed;
​
function closePot() external onlyOwner {
require(!isPotClosed, "Pot already closed");
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
i_token.transfer(msg.sender, managerCut);
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
for (uint256 i = 0; i < claimants.length; i++) {
_transferReward(claimants[i], claimantCut);
}
}
isPotClosed = true;
remainingRewards = 0;
}

Reset remainingRewards to zero after distribution to ensure accurate state.

By implementing these recommendations, the contract will be more secure and resistant to potential exploits or unexpected behaviors related to multiple pot closings.

Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.