MyCut
AI First Flight #8
Beginner FriendlyFoundry
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Users Can Invoke `claimCut` Prior to Contest Being Funded — Bad UX and Shortened Claim Window

aiada

Description

createContest and fundContest are separate operations. Users can call claimCut() before the contest is funded, resulting in a confusing ERC20InsufficientBalance revert.

More critically, the 90-day claim timer starts at Pot deployment (i_deployedAt = block.timestamp in the constructor), not when the contest is actually funded. If funding is delayed, users effectively have a shorter claim window than the intended 90 days.

// Pot.sol:28 — Timer starts at deployment, not funding
i_deployedAt = block.timestamp;
​
// Pot.sol:37 — No check if pot has been funded
function claimCut() public {
address player = msg.sender;
uint256 reward = playersToRewards[player];
...
}

Risk

Likelihood:

  • createContest and fundContest are separate transactions — funding delay is expected

  • Any user can attempt claimCut between deployment and funding

Impact:

  • Users receive confusing revert errors (ERC20InsufficientBalance) instead of a clear "not funded yet" message

  • If funding is delayed by N days, the effective claim window is reduced to (90 - N) days

  • Poor user experience erodes trust in the protocol

Proof of Concept

PoC test (click to expand)
function testClaimCutBeforeFunding() public {
// Create contest but DON'T fund it
vm.prank(owner);
address potAddr = manager.createContest(players, rewards, IERC20(address(token)), totalRewards);
​
// User tries to claim — gets confusing revert
vm.prank(player1);
vm.expectRevert(); // ERC20InsufficientBalance — unhelpful error
Pot(potAddr).claimCut();
​
// Warp 30 days, then fund — users only have 60 days now
vm.warp(block.timestamp + 30 days);
// ... fund and claim, but 30 days of the window are gone
}

Recommended Mitigation

Add a s_isFunded boolean and check it in claimCut():

+ bool private s_isFunded;
​
function claimCut() public {
+ if (!s_isFunded) {
+ revert Pot__InsufficientFunds();
+ }
address player = msg.sender;
...
}

Alternatively, fund the contest atomically during creation:

function createContest(...) public onlyOwner returns (address) {
Pot pot = new Pot(players, rewards, token, totalRewards);
contests.push(address(pot));
contestToTotalRewards[address(pot)] = totalRewards;
+ fundContest(contests.length - 1);
return address(pot);
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 5 hours ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-02] **[L-1] users can invoke `claimCut` prior to the contest being funded**

````markdown **Description:** It is possible that once the contest has been created, it is not necessarily funded at the same time, these are separate operations, which may result in users attempting to invoke `claimCut`, however there would be no funds and we would most likely get a `ERC20InsufficientBalance` error. Users have most probably assumed that at the time of claiming their cut that the contest is funded. The more insidious issue lies in the fact that the timer of 90 days begins when the Pot contract is constructed not when it's funded, hence if the contract is not funded at the time of creation, users will not be entitled to the whole 90 day duration claim period. **Impact:** Bad UX, as users would be able to attempt claim their cut but this would result in a reversion. **Proof of Concept:** The below test can be added to `TestMyCut.t.sol:TestMyCut` contracts test suite. **Recommended Mitigation:** We must ensure the contest is funded at the time it is created. Otherwise we should state a clearer error message. In the event where we want to give the users a more gracious error message, we could add the following changes which leverages a boolean to track if the Pot has been funded: ```diff contract Pot is Ownable(msg.sender) { /** Existing Code... */ + boolean private s_isFunded; // Ensure this is updated correctly when the contract is funded. function claimCut() public { + if (!s_isFunded) { + revert Pot__InsufficientFunds(); + } address player = msg.sender; uint256 reward = playersToRewards[player]; if (reward <= 0) { revert Pot__RewardNotFound(); } playersToRewards[player] = 0; remainingRewards -= reward; claimants.push(player); _transferReward(player, reward); } } ``` In the scenario where we want to ensure the contest is funded at the time of being created employ the following code. ```diff function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) public onlyOwner returns (address) { // Create a new Pot contract Pot pot = new Pot(players, rewards, token, totalRewards); contests.push(address(pot)); contestToTotalRewards[address(pot)] = totalRewards; + fundContest(contests.length - 1); return address(pot); } - function fundContest(uint256 index) public onlyOwner { + function fundContest(uint256 index) internal onlyOwner { Pot pot = Pot(contests[index]); IERC20 token = pot.getToken(); uint256 totalRewards = contestToTotalRewards[address(pot)]; if (token.balanceOf(msg.sender) < totalRewards) { revert ContestManager__InsufficientFunds(); } token.transferFrom(msg.sender, address(pot), totalRewards); } ``` ````

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!