Sparkn

Summary

If Unexpected ETH or ERC20 tokens are sent to this contract, it's stuck indefinitely as it does not have any functions to send out unexpected ETH or ERC20 tokens.

Vulnerability Details

Even though the smart contract does not include receive() or fallback() functions, ETH and ERC20 tokens can be expectedly sent to the smart contract in the following way:
Someone can create an attacker contract that has a selfdestruct method and when selfdestruct() is called, it can have the ETH sent to the distributor contract which forcibly receives the ETH even though receive or fallback methods aren't defined. This ETH will be stuck in the contract forever.

Additionally, with the current logic, unexpected ERC20 tokens can only be divied up amongst winners and the STADIUM_ADDRESS. But there will be no way for the ERC20 tokens to be returned to its owner if there is some mistake or other reason to do so.

Impact

ETH is stuck in the contract forever with no way of retrieving it.

Tools Used

VS Code

Recommendations

Implement a withdraw function to create the ability to withdraw unexpected ETH.
Add a function to handle unexpected ERC20 token transfers.