If sponsors fund contest with multiple token types i.e. USDC and DAI both are used then the organizer can distribute only one of them to the winners as Distributor.sol::distribute
doesn't handle the distribution of multiple tokens.
Let's say sponsor A funds the contest xyz with USDC and sponsor B with DAI, then organizer can only distribute DAI or USDC but not both.
Let's say organizer distributes USDC by calling ProxyFactory.sol::deployProxyAndDistribute
, but trying to distribute DAI again by ProxyFactory.sol::deployProxyAndDistribute
or ProxyFactory.sol::deployProxyAndDistributeBySignature
will cause these functions to revert because of the below line in these functions as the proxy has already been deployed when organizer distributed USDC.
Note: Same is the case with ProxyFactory.sol::deployProxyAndDistributeByOwner
if owner tries to do the same.
Note 2: ProxyFactory.sol::distributeByOwner
cannot be used here as its clearly mentioned in the comments at line
ProxyFactory.sol#L196
@notice Owner can rescue funds if token is stuck after the deployment and contest is over for a while
ProxyFactory.sol#L197
@dev only owner can call this function and it is supposed not to be called often
Add the following modifier, function and test to OnlyProxyTest.t.sol
Only 1 out of multiple tokens funded to the contest can be distributed by organizer and the rest will stay stuck until owner uses ProxyFactory.sol::distributeByOwner
to distribute the tokens which is reportedly can only be used to recover the funds sent after the deployment of proxy and this function supposed not to be called often.
Manual Analysis
Modify Distributor.sol to distribute multiple tokens to winners, below is the modified distribute function.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.