Sparkn

Summary

This one very similar to the issue where if one of the winners is blacklisted then all the legit ones wont receive their prizes, but instead of the winners it is the STADIUM_ADDRESS that might be blacklisted. When the loop is complete in the function _distribute it calls the internal function _comissionTransfer which sends the commission to the STADIUM_ADDRESS and if this address is blacklisted the funds are locked and it all reverts.

Vulnerability Details

This function is called inside _distribute()

Impact

If the STADIUM_ADDRESS is blacklisted by the token being distribute even if all the winners are legitimate (Which is another issue if they are not) the function will still revert and the funds will be stuck.

Tools Used

Manual review

Recommendations

I believe the only way to not leaving all the prize locked forever is by adding a function to change the STADIUM_ADDRESS and making it not immutable.