Sparkn

Summary

In function _distribute in Distributor.sol contract missing check for duplicates winners address. So if organizator pass two or more time same winner, the winner will receive more then one reward.

Vulnerability Details

In Distributor.sol contract in function _distribute organizator pass token address, winners addresses, and precent of winning from pot. In function no have check if in array of winners addresses have duplicate entries. So if organizator pass same winner two times , the winner will receive two rewards

Impact

Receive two or more rewards for same winner

Tools Used

Manual Review

Recommendations

Create function to check if in array of winners have duplicate entries of same address and add it as require condition in _distribute function.