Submission Details
Severity:
no validation on calldata when distributing funds
Summary
No validation on calldata when distributing funds
Vulnerability Details
When the organizer or owner distributes funds there is no check on the calldata that the distribute function selector in Distributor.sol is called
Impact
There is a small risk of the transfer of whitelisted tokens being delayed if the calldata with the distribute function selector isn't passed
Tools Used
Manual Review
Recommendations
add a a check in _distribute method in the proxy factory https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/ProxyFactory.sol#L249
bytes4(data) == function_selector_of_distribute
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.