Summary

In Distributor contract we iterate over the array of the winners two times (first time over the percentage array to check if the percentages are correctly distributed). If we check this, then we consider the system to be less reliable to the off-chain actors provided data. This is why providing limit for winners array is essential for having a reliable system.

Vulnerability Details

Having 5 winners, which is considered normal and acceptable scales to 150 000 gas. We can think as 30 000 gas per winner. Currently we don't have check, so very big number of winners could lead to too high gas prices to distribute the prizes and so DoS the contest.

Impact

DoS the contest if a large number of winners are passed.

Tools Used

Manual Review

Recommendations

Implement max number of winners on each distributor implementation.