Sparkn

Summary

Any wallet blacklisted will block the distribute process. E.g. USDC and USDT use this feature.

Vulnerability Details

Even though the contract uses safeTransfer to send the tokens to the winner, this function will revert if the recipient is blacklisted. In this case that address can be removed from the winner list, an the issue will be solved. But, in a worst case scenario, if the STADIUM_ADDRESS is blacklisted, the whole distribution process will be blocked for ever.

Impact

Probability: Low. Is not likely that the STADIUM_ADDRESS is blacklisted.
Severity: High. The distribution process would be blocked irreversibly.

Tools Used

Solodit.

Recommendations

Make STADIUM_ADDRESS a parameter of the distribution function, so it can be changed in case of emergency.