Root + Impact

The Pot constructor iterates over the players array and accesses the corresponding element in rewards without checking that both arrays have the same length. If players.length exceeds rewards.length, accessing i_rewards[i] reverts, causing createContest() to fail. This prevents the owner from creating the contest with the supplied inputs.

The issue occurs whenever the owner supplies more players than reward entries. It is an input-validation and availability issue rather than a permissionless fund-draining vulnerability.

Description

The constructor copies both arrays and then iterates over the players without validating their lengths

If the players array contains two addresses but the rewards array contains only one value, the second iteration attempts to read an out-of-bounds array element. Solidity reverts the transaction, so the contest cannot be created with those inputs.

Risk

Likelihood: An inconsistent input pair reliably triggers the revert.

Impact: Contest creation fails, but the owner can recover by supplying arrays with matching lengths. No direct loss of funds is established by this issue.

Proof of Concept

Expected result: The constructor reverts when it accesses i_rewards[1], which does not exist.

Recommended Mitigation

Validate the array lengths before storing or processing the supplied values.

This provides a clear validation error and prevents invalid configurations from reaching the reward-assignment loop.