Summary

If any of the recipient addresses (winners) fails to accept the tokens (due to reasons such as being blacklisted), the entire distribution transaction will revert, preventing all winners from receiving their tokens.

Vulnerability Details

The _distribute function is designed to transfer tokens to a list of winners based on specified percentages. Each transfer operation is dependent on the previous one. If a single transfer fails for any reason, including an address being blacklisted or having no available balance, the entire transaction will be reverted, and no tokens will be distributed to any of the addresses in the list.

Impact

Unable to distribute rewards to winners

Tools Used

Manuel reviews

Recommendations

Individual Error Reporting: Implement specific error messages for each address in case of a transfer failure. This provides clarity on which address caused the transaction failure.

Such as

So that the distributor can remove the address from the winners array and re initiate the distribution process.