Sparkn

Summary

When the organizer don't call the deployProxyAndDistribute function in the time range then owner of the ProxyFactory contract is eligible to do this but they can be malicious at this point and can send the winnings to their own addresses.
Also, as the data is not on-chain, so there is a big question mark from where the owner will get the data from.

Vulnerability Details

The owner can feed any data to distribute the winnings and also if the owner is genuine then how the owner will get the data from and is the data provided by the Organizer correct all the time.

Impact

Negative impact on the protocol as there is no trusted or verifiable way to get the data.

Tools Used

Manual Testing

Recommendation

• The organizer should sign the message which contains winner address, contest id and that must be verified in the distribute contract, so in case if the signature don't match with the organizer's address then we need to revert.