Sparkn

Summary

The getProxyAddress function exposes the addresses of potential contests, even those that have not been approved by the owner. This can lead to sponsors sending assets to proxy addresses that may never be deployed through the ProxyFactory contract.

Vulnerability Details

The getProxyAddress function currently lacks a check to verify whether a contest has been added by the owner. As a result, it returns addresses for hypothetical contests, which may never be deployed using the ProxyFactory contract. This situation can mislead sponsors into sending assets to proxy addresses that are not intended for actual use.

Impact

Medium - The getProxyAddress view method provides addresses for contests that have not been approved by the owner, potentially causing misallocation and loss of assets.

Tools Used

Manual review

Recommendations

Consider checking whether contest was set in the ProxyFactory contract before evaluating and returning the address