Sparkn

Summary

The contract allows an organizer to manage their funds. This is NOT what an escrow is supposed to do.

Vulnerability Details

Escrow definition from investopedia:
Escrow is a legal concept describing a financial agreement whereby an asset or money is held by a third party on behalf of two other parties that are in the process of completing a transaction.

This allows an organizer to send funds to themselves

https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/ProxyFactory.sol#L130

Impact

Loss of winnings for supporters if keys are compromised or an organizer is malicious.

Tools Used

Recommendations

By definition of an escrow funds should be managed by a third party. Therefore the owner or another trusted entity should be in charge of distributing winnings.