Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`Distributor` contract: DoS of distribute function if `STADIUM_ADDRESS` is a blacklisted address by the reward token

0xhals

Summary

Distributor contract: reward tokens will be stuck in the contest proxy contract if STADIUM_ADDRESS is a blacklisted address in the reward token.

Vulnerability Details

  • In Distributor contract : STADIUM_ADDRESS is the address of the commission fees receiver.

  • This address is immutable; once set in the constructor and can't be re-set again.

  • When the contest organizer invokes the distribute function via ProxyFactory contract; the rewards are sent to the winners as a percentage of the contract token balance; and the remaining tokens are sent to the STADIUM_ADDRESS.

  • But some tokens have a blacklist where certain accounts are prohibited from having/transferring any tokens.

  • So if the STADIUM_ADDRESS is set in the blacklist of reward token (if it has a blacklist); which will result in DoS & tokens will be stuck in the contract as the distribute function will always revert.

Impact

Rewards tokens will be stuck in the Distributor contract and contest winners will not receive their rewards.

Proof of Concept

Line 154:

File: 2023-08-sparkn/src/Distributor.sol
Line 154: _commissionTransfer(erc20);

_commissionTransfer function:

File: 2023-08-sparkn/src/Distributor.sol
Line 163-165:
function _commissionTransfer(IERC20 token) internal {
token.safeTransfer(STADIUM_ADDRESS, token.balanceOf(address(this)));
}

Tools Used

Manual Testing.

Recommendations

  • Check (off-chain) if the STADIUM_ADDRESS is a blacklisted account in the rewards token or not before creating the contest.

  • Or add a function to change the STADIUM_ADDRESS by the ProxyFactory owner.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.