In the closePot function, the managerCut and claimantCut are calculated based on the remainingRewards state variable. However, the function does not set remainingRewards to zero or mark the pot as closed after transferring the funds. Because this function is restricted to the owner, the owner can repeatedly call closePot to continuously extract the managerCut (and send multiple cuts to claimants) until the contract's token balance is completely drained, violating the intended privileged flow and reward distribution logic.
The contest is live. Earn rewards by submitting a finding.
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsThe contest is complete and the rewards are being distributed.