Sparkn

Summary

In line 147, the safeTransfer method can fail and thus no one gets paid.

Vulnerability Details

If a winner is an exploitative contract, it can purposely reject the transfer from this contract. When it does that, the safeTransfer method fails causing the entire transaction to revert resulting in no one gettin paid and the STADIUM_ADDRESS won't receive commission.

Impact

No one will get paid for their work which is the worst-case scenario for participants. This, combined with the fact that there is no way to retrieve erc20 tokens sent to the contract outside of this distribution means that erc20 tokens will be stuck on the platform and will cause users not to trust the platform.

Tools Used

VS Code

Recommendations

Have business logic to deal with failing transfers

• use the call method instead to transfer payments so that the status of the payment can be received and handled based on the business logic defined. e.g.

Also use OpenZeppelin's Re-entrancy Guard in this instance since low level calls increase the opportunity for reentrancy attacks.
Use the call method instead to handle payments so that way you can