MyCut

AI First Flight #8
Beginner FriendlyFoundry
EXP
View results
Submission Details
Impact: high
Likelihood: high
Invalid

closePot does not update remainingRewards, allowing the owner to repeatedly drain funds

In the closePot function, the managerCut and claimantCut are calculated based on the remainingRewards state variable. However, the function does not set remainingRewards to zero or mark the pot as closed after transferring the funds. Because this function is restricted to the owner, the owner can repeatedly call closePot to continuously extract the managerCut (and send multiple cuts to claimants) until the contract's token balance is completely drained, violating the intended privileged flow and reward distribution logic.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge 4 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!