Sparkn

Summary

An attacker can front run an organizer and steal funds

Vulnerability Details

When owner set the contest sponsor/organizer sends ERC20 token to the anticipated/calculated proxy contract address.

The address of the new proxy depends solely upon the salt parameter. Once the owner's create transaction is broadcasted, the salt parameter can be viewed by anyone watching the public mempool.

If an organizer intends to create a new proxy and deposit some funds into it, an attacker can front-run the organizer's transactions, create a proxy, and capture the deposited amounts by distributing them to addresses that the attacker controls

Impact

All funds can be stolen

Tools Used

Manual Review

Recommendations

Split the transaction process into multiple steps. For example, first, the organizer can initiate the creation of the proxy contract without sending funds. Once the contract is created, a separate transaction can be used to deposit funds into it. This reduces the exposure of sensitive information in a single transaction.