Summary

Vulnerability Details

Since the Distributor contract does not hold the reward deposit amount of each contest. It's using the entire balance of the token in the contract to transfer as the reward.
Which might result in using the reward deposit of other contests with similar token rewards.

Not using the same token as a reward will be out of the question since the most used tokens for task-related rewards is USDC/USDT/DAI etc. So, using just 1 contest with those rewards for the duration of over a month is bad for the project.

Impact

No reward left to distribute for other contests. More token rewards for the claiming contest.

Tools Used

Manual Review

Recommendations

Add an accounting for the reward deposited to the contract by the sponsor and use the deposited amount to distribute the rewards.