Sparkn

Summary

Distributor.sol: if any of the winners is blacklisted from the rewards tokens; then this will DoS of rewards distribution.

Vulnerability Details

• Contest rewards are distributed to the winners after the contest ends.

• The rewards are distributed to the winners by invoking any of the deployProxyAndDistribute, deployProxyAndDistributeBySignature & deployProxyAndDistributeByOwner functions in the ProxyFactorycontract.

• This will call thedistribute function in the implementation (Distributor) contract; which will distribute the rewards for each winner in a loop:

  for (uint256 i; i < winnersLength;) {

  uint256 amount = totalAmount * percentages[i] / BASIS_POINTS;

  erc20.safeTransfer(winners[i], amount);

  unchecked {

  ++i;

  }

  }

• But some tokens have a blacklist where certain accounts are prohibited from having/transferring any tokens.

Impact

• So if any of the winners is blacklisted in the reward token; then this will prvent rewards distribution to other winners as the distribute function will always revert.

Proof of Concept

distribute function/Line 147:

Tools Used

Manual Testing.

Recommendations

Add a mechanism in the Distributor contract that enables each winner from claiming his rewards individually (pulling) instead of sending it directly (pushing).