Sparkn

Summary

Whitelist for the tokens that can be in contest and distributed is immutable and can be changed which can cause problems

Vulnerability Details

There is no way to remove a whitelisted token from the mappings
which if the deployer makes a mistake or includes a wrong token they would need to Redeploy (waste gas)
Since there is no way to remove a whitelisted token from the mapping it can cause an exploited token in contests to be used in distribute function.

Impact

So if we did make a mistake we would have to redeploy but let's say it happens after a contest is made, then a token that got hacked/ has an exploit is still allowed to be distributed.

Tools Used

Recommendations

have a function that allows whitelisted tokens to be turned false/true and just in case set whitelisted tokens to false in the constructor.