Sparkn

Summary

A missing zero address check of the winner address in the _distribute function of Distributor.sol can lead to an accidental loss of funds.

Vulnerability Details

In the _distribute function it is checked if the length of the winners array is bigger than zero, but a check if the addresses, or at least the first one is not the zero address is missing. Zero address checks are general a good practice and if a zero address is accidentally passed to this array funds that belong to supporters will be transfered to address(0) instead and therefore be burned.

Impact

Loss of funds

Tools Used

Manual Review, Foundry, VSCode

Recommendations

Revert if the winner is the zero address.