Sparkn

Summary

Organiser can distribute any funds contributed by external sponsors to himself as long as he sets his own EOA as one of the winners.

Vulnerability Details

Organiser simply calls deployProxyAndDistribute with his own EOAs as winners in the delegate call calldata and it will pass the params to the actual implementation function in Distributor.sol.

Impact

This is classified as medium in the event that the organiser is malicious. Depending on the amount of funds contributed by external sponsors, it could be very severe if the contests are rigged like that. Although it is stated that organiser is trusted, but judging directly based on the code base, this is still a medium vulnerability.

Tools Used

Foundry

Recommendations

Employ an anti-sybil measure (difficult and might not be feasible) to prevent this from occurring, or at least require that the organiser cannot be a winner as well as a first step.