Sparkn

Summary

At the end of the contest period, the organizer can put himself as a winner and get back all the funds of the contest including the Sponsor funds and the work of the Supporters will have been done for free.

This goes against the claim that:

All the funds belong to the persons who wants to help solve the problem, we call them "supporters"

Vulnerability Details

In the deployProxyAndDistribute function, the organizer has the full rights to choose who will receive the rewards of the contest.
Imagine the following scenario:

• The Owner creates a contest for the Organizer.

• Some Sponsors appreciate the idea of the contest and provide funds to the contest.

• Supporters work on the contest.

• At the end of the contest, the Organizer selects is own address as unique winner and gets all the money invested in the contest, without rewarding any Supporter.

Impact

Organizer can "rug-pull" a contest.

Tools Used

Manual review

Recommendations

We recommend to use a trusted third party escrow to judge the contests reward distribution.