Sparkn

Summary

As the data of winners is not stored on-chain, so there is a high risk of malicious organizers being in the protocol and can betray the winners and send all the winnings to their own people.

Vulnerability Details

This is a high vulnerability as it involves getting the data from any off-chain source for which we don't have any proof.

Impact

It will have a negative impact on the reputation of our protocol.

Tools Used

Manual Testing

Recommendations

• Also we can make the organizer to stake on the ProxyFactory contract with some amount and only after verification by the officials of Sparkn protocol that the winners are genuine, we can refund the staked amount of organizer to them.

• We can involve zk-proof to verify the identity of the organizer and then only allow them to set up their contest.
  We should not trust anyone, always verify.