MyCut

Root + Impact

The protocol gives claimants 90 days to claim; after that the pot is closed and the remainder is redistributed. But claimCut() contains no time check at all and closePot() does not clear the unclaimed entries in playersToRewards. A player who ignored the deadline can therefore call claimCut() after the pot has been closed and still withdraw their full original reward, paid out of whatever balance remains in the pot (leftovers from the closing distribution). This breaks the core incentive of the design: waiting past the deadline is never punished, the late player double-dips into funds that were already reassigned to the manager and the timely claimants, and their late claim additionally pushes them into the claimants array, polluting any subsequent distribution.

Description

Risk

Likelihood: High - any authorized player can do it at any time after the deadline, including after closing; nothing in the code path resists it, and leftover balances for it to draw from are the norm.
Impact: Medium - the late claimant takes a full original cut (25 of a 100-token pot in the PoC) out of funds already redistributed to others, so the timely claimants' and manager's closing payouts are effectively clawed back on a first-come basis; the deadline the whole product is built around ("90 days to claim") is unenforceable.

Proof of Concept

Verified with Foundry (test passes). Player 1 claims in time; players 2 to 4 do not. After 91 days the owner closes the pot and the remainder is distributed. Player 2 then calls claimCut() and still receives their full 25-token original cut.

Recommended Mitigation

Enforce the claim window in claimCut and refuse claims once the pot is closed: