Sparkn

Summary

All of ProxyFactory's distribution functions (deployProxyAndDistribute for example) don't force a call to the distribute function on the proxy. They can call any function on the proxy instead of distribute.

Vulnerability Details

These distribution functions perform the distribution by making a low-level call to the function specified by the given data argument. This argument is never tested to actually contain distribute's function selector. This low-level call can be to any external function available on the proxy contract - like the getConstants view function.

Impact

When contest organizers (or anyone else) try to distribute the prizes through one of ProxyFactory's functions (deployProxyAndDistribute for example), they can choose which function to call on the proxy, and if it's not the distribute functions, all the prizes will remain inside that proxy contract (until ProxyFactory's owner would call distributeByOwner by itself).

Recommendations

Force all ProxyFactory's distribution functions to call the distribute function on the proxy specifically, and don't allow to select which function to call.