Sparkn

After a contest ends it get expires after 7 days then owner can decide what to do , owner can even pass his own address as a winner and go away with the rewards if sponsor has deposited to proxy address which is to be deployed.Likelihood for such thing is really low because owner is trusted but as owner can pass any arbitrary bytes data as data, owner can do whatever he wants so the risk is high therefore medium severity;

Mitigation steps

In current model there's no feature to keep in track who are participating for the contest so consider adding such thing may be something like a mapping participants to an id and make sure winners out of them getting included in the distribution of rewards