MyCut

Description

totalRewards is never checked against sum(rewards): underfunding bricks later claims (first-come-first-served loss); overfunding strands excess. players.length != rewards.length unchecked: extra rewards silently ignored. An empty players array passes creation, then closePot reverts with division-by-zero forever → funded tokens locked. fundContest(index) has no bounds check (owner-only).

Impact

Underfunded contests lose claims; overfunded or empty-player contests lock tokens permanently.

Recommended Mitigation

require(players.length == rewards.length && players.length > 0) and require(totalRewards == sum(rewards)).