Sparkn

Summary

While it is stated in the readme that issues related to owner rugging were not accepted, it is also possible for the organizer to rug funds, and no where was it stated in the readme that this is acceptable.

Vulnerability Details

from the readme this is stated as a known issue and acceptable risk

Owner is in charge of some of the key functions of the protocol. Owner's centralization risk is not an issue to be considered this time.

however the readme does not have centralization risk by the organizer as a know issue.

The organizer can simply steal funds by adding himself as the only winner and allocating himself 95% of the tokens.

He can essentially now steal all of the sponsors funds that should have gone to the winner.

Impact

Organizer can steal funds of the contest.

Tools Used

manual review

Recommendations

have the winner list be validated by either the owner or a sponsor/3rd party.