Sparkn

Summary

When the owner or organizer calls distribute to allocate the money to the winners, they can simply list themselves as winners. This would result in the rightful winners receiving less money.

Vulnerability Details

When a contest is over, the organizers (or after the expiration time, the owner) are responsible for ensuring that the winners receive their money. However, they can also simply designate themselves as winners and receive the money. In this way, the actual winners receive less or no money.

Impact

The true winners receive less or no money and the organizer or the owner receive the money.

Tools Used

Manual Review

Recommendations

Even though organizers and owners are trusted, it would make sense to implement a check since a little less trust is required in this case. In Distributor.sol, in the _distribute function, the address should be checked before sending the tokens to the winners.

Owner and organizer would need to be passed as parameters to the function.