MyCut

Severity: L · Impact: M · Likelihood: L

Description

• The owner alone can create, fund, and close pots. closeContest (the only trigger for the leftover-pool distribution to in-time claimants) is onlyOwner.

• The 90-day window enforced in closePot protects timing, but nothing forces the owner to ever call it. A negligent, unavailable, or compromised owner can leave the remaining pool undistributed forever, and there is no fallback path for claimants.

Risk

Likelihood

• Low: the owner is a Trusted actor per the README; this is a trust/liveness assumption rather than a permissionless exploit.

Impact

• Medium if it materialises: the leftover pool (manager cut plus the in-time claimants' shares) is frozen with no user-accessible recovery.

Proof of Concept

By design, no non-owner call can advance a pot past the claim window. If the owner never calls closeContest, remainingRewards stays in the Pot indefinitely; claimants who claimed in time never receive their share of the leftover, and no one else can trigger the distribution.

Recommended Mitigation

Make the close permissionless after the window (the closePot 90-day check already gates timing, and the manager cut still accrues to the ContestManager regardless of caller), or place the owner behind a timelock/multisig.

Why: removing the single point of failure lets any in-time claimant force the distribution once the window elapses, without changing who receives the manager cut.