Sparkn

Summary

Malicious supporters can provide a blacklisted address to DOS the distribution for all legitimate winners.

Vulnerability Details

Distributor#distribute sends the prize token in a loop - if one call fails, the whole transaction reverts.

Scenario:

1. Bob contributes to a contest.

2. Bob sees that preliminary rewards significantly undervalue his contribution (at least in his opinion).

3. Bob provides a blacklisted address for his tiny prize so the whole distribution txn will revert.

Impact

Winners are unable to receive prizes until mitigated.

As there will be a reputation system that will punish organizers for changing distributions by themselves, organizers would wait for the owner to distribute prizes. This would impact one of the core organizer's actions for one week.

Therefore, medium risk.

Tools Used

Manual review

Recommendations

• Web2 solution: Allow organizers to exclude blacklisted addresses from the distribution without reputation penalty.

• Web3 solution: Add blacklist check for every winner to Distributor.sol (could be gas-expensive if there are many winners).