Root + Impact

Players can call claimCut() after the 90-day claim period has expired because the function does not check the contest's expiration time. This bypasses the apparent claim deadline and may interfere with the owner's final reward distribution through closePot().

Description

The root cause is that claimCut() validates the player's reward but does not verify whether the 90-day claim period has expired.

Because this expiration check is absent from claimCut(), players can still claim their allocated rewards after the stated period.

Risk

Likelihood: The missing check is directly reachable by players with unclaimed rewards after the deadline.

Impact: The intended expiration policy can be bypassed, and late claims can alter the remaining reward balance and claimant list used by the final distribution logic.

Proof of Concept

Expected result: The call should revert because the claim period has expired. The current implementation allows it to proceed if the player still has an outstanding reward and the pot has sufficient funds.

Recommended Mitigation

Add an expiration check at the beginning of claimCut() so that claims are accepted only during the intended 90-day window.

For clarity, consider introducing a dedicated Pot__ClaimPeriodExpired() error. Ensure that closePot() and claimCut() follow a consistent deadline policy.