Sparkn

Summary

if owner is malicious, he can put wrong value in contestId. this will effect on salt and as well as proxy contract deployments. so, we have to make a counter to store the contestId index.

Vulnerability Details

if contestId is wrong, It create variation in the salt and this will result the deployment of different contract. for example, if contestId is different then it create a new salt value and passes this below code:

and deploy new proxy contract.

Impact

An arbitrary bytes32 contestId can be pass in the arguments of the function.

Tools Used

Manual Review

Recommendations

We can use a uint256 counter for contestId and avoid to take in the arguments.