Sparkn

Summary

Contest organizers (or whoever distributes the prizes) can only distribute the prizes that were collected in one kind of token, while contests should be able to collect multiple kinds of tokens (as long as they're all whitelisted).

Vulnerability Details

In order to distribute the prizes, contest organizers must call deployProxyAndDistribute (or let someone else call deployProxyAndDistributeBySignature with the organizer's signature). There's no other way to distribute the prizes. These function can't be called twice because they also deploy the proxy, and one can't deploy two proxies with the same salt. Since the distribute function distributes only the prizes collected in one kind of token, the rest of the token prizes can't be distributed.

Impact

Prizes only in one kind of token can be distributed to winners, per contest. Only ProxyFactory's owner will be able to distribute all the other token prizes by calling distributeByOwner when the contest expire.

Recommendations

Modify the distribute function to receive a list of tokens to be distributed instead of just one.