Sparkn

Summary

The _distribute() of Distributor.sol sends amount back to the winners in a loop which may cause serious problem if the transfer reverts.

Vulnerability Details

This protocol accepts USDC token which can be blacklisted and token transfer to the blacklisted address always reverts.

Impact

As the likelihood of winners token getting blacklisted is very low, but if it does, the whole distribute() function reverts which will brick the withdrawal process. Then the blacklisted winner needs to be removed and distribute() needs to be called again with different data which is not possible in case of meta-transaction using deployProxyAndDistributeBySignature(). Hence, The owner need to call deployProxyAndDistributeByOwner() by removing the blacklisted winner which will again take a additional week to be called. But tokens are not stuck forever, hence the low severity.

Tools Used

Manual Analysis.

Recommendations

Use pull over push pattern. Implement a withdraw() for winners to be able to withdraw their tokens themselves instead of manually sending them in a loop.