MyCut

Root Cause: The claimCut function transfers tokens without reentrancy protection.

Line 32-40:
@> function claimCut() public {
@> address player = msg.sender;
@> uint256 reward = playersToRewards[player];
@> if (reward <= 0) {
@> revert Pot__RewardNotFound();
@> }
@> playersToRewards[player] = 0;
@> remainingRewards -= reward;
@> claimants.push(player);
@> _transferReward(player, reward);
@> }

Impact: Attacker could re-enter through malicious token and withdraw multiple times.

Proof of Concept: Malicious token contract calls claimCut again during transfer.

Recommended Mitigation: Add nonReentrant modifier from OpenZeppelin.