Sparkn

Summary

The owner ownership can be transferred during an open contest. The new owner address can be the organizer address of the open contest.

Vulnerability Details

Transferring the ownership to the organizer reduces the number of persons allowed to the prize distribution to one. This could cause the block of the funds of the contest. In normal conditions, if the organizer doesn't distribute the price, the owner is entitled to distribute the prize after a certain period. If the owner is the same as the organizer and he/she doesn't distribute the prize, it remains blocked in the smart contract forever.

Impact

The supports don't receive the prize and the tokens remains blocked in the smart contract.

Tools Used

Manual

Recommendations

Modify the transferOwnership adding an if statement that checks the new owner address and in case it is the same as an organizer revert the function.