Summary

The function distributeByOwner(...) allows for distributing tokens from the proxy address with arbitrary salt, in effect allowing to distribute funds for non-expired contests.

Vulnerability Details

The function distributeByOwner(...) allows the owner to distribute funds from the given proxy only after it is expired, i.e. after closeTime + EXPIRATION_TIME. However, the function allows does not check if provided proxy address corresponds to the salt computed from the organizer, contestId, and implementation arguments. In effect, the fetched timestamp stored in saltToCloseTime[salt] may not correspond to provided proxy address.

Impact

This may result in the owner mistakenly making a call to an arbitrary address and in effect distributing funds from a non-expired proxy address.

Tools Used

Manual review

Recommendations

Consider retrieving the proxy address by calling getProxyAddress(...) with provided implementation and computed salt, instead of providing proxy as an argument to distributeByOwner(...)