MyCut

AI First Flight #8
Beginner FriendlyFoundry
EXP
View results
Submission Details
Impact: high
Likelihood: high
Invalid

[H] user still can claim after 90 days or closePot

[H] user still can claim after 90 days or closePot

Description

  • User still can claim after 90 days or closePot. The claim function does not check the time.

  • And, closePot not clear user's claim credit playersToRewards, user can still claim after close pot.

@> function claimCut() public {
address player = msg.sender;
uint256 reward = playersToRewards[player];
if (reward <= 0) {
revert Pot__RewardNotFound();
}
playersToRewards[player] = 0;
remainingRewards -= reward;
claimants.push(player);
_transferReward(player, reward);
}

Risk

Likelihood: High

  • User always can claim after 90 days or close pot.

Impact: High

  • This sure will break protocol's purpose!

Proof of Concept

  1. Pot pass 90 days or closed

  2. User still can call claim

Recommended Mitigation

In claim function, add check for time and if pot has closed:

function claimCut() public {
+ if (block.timestamp - i_deployedAt > 90 days) {
+ revert Pot__NotOpenForClaim();
+ }
address player = msg.sender;
uint256 reward = playersToRewards[player];
if (reward <= 0) {
revert Pot__RewardNotFound();
}
playersToRewards[player] = 0;
remainingRewards -= reward;
claimants.push(player);
_transferReward(player, reward);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 15 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!