Sparkn

Summary

The distributeByOwner function is expected to fail and revert if given a non-existing proxy address as argument (could happen if the proxy of that contest was never deployed), but instead it doesn't revert and even emit a Distributed event as if it were distributing the prizes successfully.

Vulnerability Details

Since the call to the proxy's distribute function is done as a low-level call, there is no check for the contract existence. This check is crucial because EVM considers a call to a non-existing contract to always succeed (see 3rd warning here).

Impact

The function would failed to distribute the prizes but won't revert, and would even emit a false Distributed event.

Recommendations

Don't call the proxy's distribute function using a low-level call. Do it using a high-level call instead.