Sparkn

Summary

Rewards distribution can be front-run

Vulnerability Details

An attacker can front-run the distribute function call and can insert inputs that will benefit him to get all or major part of reward distribution.
To gain rewards, a malicious user can watch the mempool for transactions that will receive a reward when the deposit occurs. When a malicious user sees deposit, the malicious user can attach a higher fee to the transaction and initiate inputs. This will allow the malicious user's transaction to front-run before the victim's transaction.

Impact

The attacker may able to steal funds, which harms the rewards of participants.

Tools Used

Manual Code

Recommendations

Approaches to calculating rewards are possible, like the Dutch auction style deposit system where rewards are distributed according to predefine criteria could reduce an impact of a frontrun attack.