Sparkn

Summary

There is a chance that the winner's address selected by the organizer can be blacklisted by token and if that is the case then the system will fail to distribute the reward.

Vulnerability Details

If the organizer selects a winner's address for reward distribution, there's a risk that the chosen address could be blacklisted. If the winner's address is indeed blacklisted, the system attempting to distribute the reward would fail since the frozen or blacklisted address would be unable to receive or transact with token contract, potentially leading to a distribution breakdown.

Impact

If the winner's account is blacklisted and he is a major contributor to the idea he will incur a huge fund loss.

Tools Used

manual review

Recommendations

If the protocol is deciding the winner off-chain then make sure the winner's address is not blacklisted, if it is soo then transfer another token with equal value to the winners and get the original token back using the distributeByOwner function.