Sparkn

Summary

The vulnerability arises from the competition's current structure, where the organizer holds the authority to select winners. This setup opens the possibility for the organizer to exploit the situation by designating themselves as the sole recipient.

Vulnerability Details

• The competition's tasks are executed on a web2.

• The owner manually chooses the competition winners.

• Monetary rewards are disbursed upon task completion.

From these three premises, it becomes evident that the organizer's distribution of funds appears altruistic. Upon competition finalization, the organizer attains their desired outcome without the obligation to allocate funds externally. This scenario sets the stage for a cost-saving exploit: the organizer can opt to declare themselves as the exclusive winner. This can be even masked to look natural, by the owner having multiple secondary addresses and choosing them as the winners in the competition.

Impact

User loss of funds.

Tools Used

Manual review

Recommendations

For this issue recommendations are hard to give, since this is about the structure of the whole project.