Sparkn

Summary

The owner of the ProxyFactory contract can call the distributeByOwner function on a certain contest's proxy before that contest's time of expiration by tricking the system with another contest that was already expired.

Vulnerability Details

The distributeByOwner never checks that the given proxy address is really the proxy of the contest that matches the given organizer, contestId and implementation parameters. The caller could specify parameters (organizer, contestId and implementation) that matches an already expired contest, along with a proxy address of a different contest that hasn't expired yet.

Impact

Doing so will allow the caller to withdraw all the tokens in the contract before they should really be able to do it (before the contest's time of expiration).

Recommendations

Don't ask for the caller of the distributeByOwner function to specify proxy as a parameter, but rather calculate it in place using the getProxyAddress view function.