Sparkn

Summary

The owner address can be added as a winner.

Vulnerability Details

The winner address can be anyone (also the owner address). The owner has the power to distribute the prize including also the winner addresses. So the owner can add his/her address as a solo winner and steal all the funds of the contest.

Impact

In the described vulnerability the steal of the funds is limited to one contest and could be rare because the organizer is entitled (before the owner) to distribute the contest prize. Also the centralization of the project is notice. But for transparency to the users and for the good name of the protocol avoiding that the owner could win the prize could be a good point.

Tools Used

Manual

Recommendations

Add an if condition for excluding the owner address in the distribution function.