Sparkn

Summary

standard blacklisting issue seen in other contests but this protocol uses stablecoins like (usdc) that have blacklisting

Vulnerability Details

A winner who is not happy with the issue can blacklist himself/contract and cause the function to revert
This can be done by frontrunning the distribute tx with a small amount of sanctioned funds, then the owner will have to call the onlyOwner function.

Impact

The attacker can cause reverts and anyone can do it.The other option is that we can blacklist the contract making the funds not accessible since in usdcProxy

Tools Used

Recommendations

Use push instead of pull by allowing that address to send out the funds if the transfer failed