Summary

The winner may be blocked by a token contract and delay the distribution of rewards.

Vulnerability Details

The _distribute(...) function loops over provided winners and sends rewards. However, if one of a winner's addresses is blacklisted by a token, then the whole transaction reverts, and other winners can't receive the reward. It may be a problem if a deployProxyAndDistributeBySignature(...) is used, and new signed data (without fault winner) can't be easily obtained. Therefore the sending of rewards would be delayed until new data can be provided, or the contest is expired and the owner may distribute rewards.

Impact

Rewards may be delayed under certain conditions.

Tools Used

Manual review

Recommendations

Consider avoiding revertion of whole transaction if one of the transfers can't be made.