Sparkn

Summary

Because contest organizers can freely choose reward recipients, they can distribute all rewards to themselves.

Vulnerability Details

PoC:

1. Malicious organizer arranges contest off-chain.

2. Owner calls setContest() in ProxyFactory contract.

3. Organizer and/or sponsors send tokens to the predetermined proxy address.

4. Supporters work on the contest and submit their work to the organizer for judging

5. Contest ends and organizer calls deployProxyAndDistribute() in the ProxyFactory contract, setting their own address as the only reward receiver

6. Organizer receives all of the rewards deposited by themselves and/or sponsors, minus the protocol fee. Additionally, the organizer now possesses all the work done by supporters.

Impact

Supporters receive zero awards for their work, and the organizer receives all contest funds minus the protocol fee. Protocol funds are directly at risk.

Tools Used

Manual Review

Recommendations

Do not allow the contest organizers to distribute awards. Instead, delegate reward distribution solely to the protocol owner. This would eliminate a large amount of attack surface related to malicious organizers.