Sparkn

Summary

The Contract Distributer.sol is using address(this) to calculate the balance of tokens in the contract, which then is used to calculate the amount to be transferred to the winners and the stadium fee. These values can be manipulated by sending ether forcibly.

Vulnerability Details

One example can be the selfdestruct() function, used to forcibly send ether to the contract regardless of any code that may exist in the contract. This is inclusive of contracts without any payable functions. This means any attacker can create a contract with a selfdestruct() function, send ether to it, call selfdestruct(target) and force ether to be sent to a target contract.

Impact

This vulnerability can compromise the fair distribution of tokens thus damaging the reputation and undermining the fairness of the whole protocol.

Tools Used

Recommendations

The recommendation is to use a separate mechanism to store the balance of tokens in the contract and then use them to calculate the amount of token balance to be distributed to winners and as a stadium fee