MyCut
First Flight #23
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Transfer rewards `_transferReward` calls that are executed inside a loop could potentially lead to a denial-of-service attack

soupy

Summary

An internal function of _transferReward is used in Pot:closePot to transfer the additional unclaimed rewards to those who make the claims on time. This function is executed under a for-loop which if one of the claimant destinations has a fallback function that reverts, it will cause the Pot:closePot function to revert as well.

https://github.com/Cyfrin/2024-08-MyCut/blob/946231db0fe717039429a11706717be568d03b54/src/Pot.sol#L58-L60

Vulnerability Details

In the Pot:closePot function, an internal function of _transferReward is used to transfer the additional unclaimed rewards to those who make the claims on time, but the execution of this transfer process is done under a for-loop which
if one of the claimant destinations has a fallback function that reverts, it will cause the entire Pot:closePot function to revert as well resulting any extra unclaimed rewards couldn't be transfered to eligible players.

function closePot() external onlyOwner {
if (block.timestamp - i_deployedAt < 90 days) {
revert Pot__StillOpenForClaim();
}
if (remainingRewards > 0) {
uint256 managerCut = remainingRewards / managerCutPercent;
​
i_token.transfer(msg.sender, managerCut);
​
uint256 claimantCut = (remainingRewards - managerCut) / i_players.length;
console.log("claimantCut: ", claimantCut);
for (uint256 i = 0; i < claimants.length; i++) {
<@@>! _transferReward(claimants[i], claimantCut);
}
}
}
​
function _transferReward(address player, uint256 reward) internal {
<@@>! i_token.transfer(player, reward);
}

Impact

Denial-of-service attack on Pot:closePot function if one of the claimant destinations has a fallback function that reverts during the execution of _transferReward in the for-loop

Tools Used

Manual review

Recommendations

Consider pull over push strategy for external calls.

Updates

Lead Judging Commences

equious Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.