Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Winner's address should not be allowed to be equal to that of organizer or sponsor

t0x1c

Summary

The SPARKN documentation says: "Winners are selected from the supporters", but there is no check to stop this inside _distribute() function here.

Vulnerability Details

It is natural to expect that the organizer or sponsor themselves won't be a having a supporter role, and hence can not be a winner. However, there is no such constraint applied in the code. An organizer can pass his address in the winners[] array (via data) and claim rewards, as per current code.

Impact

Reward can be distributed to organizer instead of someone from the pool of supporters.

Tools Used

Manual inspection

Recommendations

Add a check in distribute() function:

uint256 winnersLength = winners.length; // cache length
for (uint256 i; i < winnersLength;) {
​
// add this line
+ require(winners[i] != organizer_ || winners[i] != sponsor_ );
​
uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;
erc20.safeTransfer(winners[i], amount);
unchecked {
++i;
}
}
​

Note that we will have to make some more modifications so that the value of organizer_ and sponsor_ are stored in the contract, for the above to work.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.