Claim deadline starts at deployment instead of funding, shortening or eliminating the claim window
Summary
The 90-day claim period starts when the Pot is deployed, but funding is a separate owner action that may occur much later. Delayed funding gives players less than 90 days to claim and funding after the deadline lets the owner close immediately.
Root cause and evidence
Pot stores i_deployedAt = block.timestamp in its constructor at src/Pot.sol:28. closePot lines 49-52 uses block.timestamp - i_deployedAt as the deadline. Funding happens independently in ContestManager.fundContest lines 28-38, with no deadline update or funded-state tracking.
If a pot is funded on day 89, users get roughly one day. If funded after day 90, closeContest can be called in the same block before users have a meaningful opportunity to claim.
Impact
Winners can lose the intended claim opportunity due solely to manager funding timing, and funds may enter the close path immediately.
Minimal patch
Record fundedAt when funding succeeds and require closure only after block.timestamp >= fundedAt + 90 days. Prevent claims before funding and prevent multiple funding unless explicitly supported.
Regression test
Deploy a pot, wait 89 days, fund it, and assert it cannot close until 90 full days after funding. Also assert claims before funding are rejected without clearing entitlement.
Lead Judging Commences
[M-02] **[L-1] users can invoke `claimCut` prior to the contest being funded**
````markdown **Description:** It is possible that once the contest has been created, it is not necessarily funded at the same time, these are separate operations, which may result in users attempting to invoke `claimCut`, however there would be no funds and we would most likely get a `ERC20InsufficientBalance` error. Users have most probably assumed that at the time of claiming their cut that the contest is funded. The more insidious issue lies in the fact that the timer of 90 days begins when the Pot contract is constructed not when it's funded, hence if the contract is not funded at the time of creation, users will not be entitled to the whole 90 day duration claim period. **Impact:** Bad UX, as users would be able to attempt claim their cut but this would result in a reversion. **Proof of Concept:** The below test can be added to `TestMyCut.t.sol:TestMyCut` contracts test suite. **Recommended Mitigation:** We must ensure the contest is funded at the time it is created. Otherwise we should state a clearer error message. In the event where we want to give the users a more gracious error message, we could add the following changes which leverages a boolean to track if the Pot has been funded: ```diff contract Pot is Ownable(msg.sender) { /** Existing Code... */ + boolean private s_isFunded; // Ensure this is updated correctly when the contract is funded. function claimCut() public { + if (!s_isFunded) { + revert Pot__InsufficientFunds(); + } address player = msg.sender; uint256 reward = playersToRewards[player]; if (reward <= 0) { revert Pot__RewardNotFound(); } playersToRewards[player] = 0; remainingRewards -= reward; claimants.push(player); _transferReward(player, reward); } } ``` In the scenario where we want to ensure the contest is funded at the time of being created employ the following code. ```diff function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards) public onlyOwner returns (address) { // Create a new Pot contract Pot pot = new Pot(players, rewards, token, totalRewards); contests.push(address(pot)); contestToTotalRewards[address(pot)] = totalRewards; + fundContest(contests.length - 1); return address(pot); } - function fundContest(uint256 index) public onlyOwner { + function fundContest(uint256 index) internal onlyOwner { Pot pot = Pot(contests[index]); IERC20 token = pot.getToken(); uint256 totalRewards = contestToTotalRewards[address(pot)]; if (token.balanceOf(msg.sender) < totalRewards) { revert ContestManager__InsufficientFunds(); } token.transferFrom(msg.sender, address(pot), totalRewards); } ``` ````
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.