Sparkn

Summary

A new contest with the same contestId and organizer but different implementation as a previous contest could be deployed and distributed with the previous contest's data if the organizer gave out a sginature for the previous contest.

Vulnerability Details

Since contestIds do not need to be unique the digest used for ECDSA.recover could be the same as a previous contest with the same id and data. If an organizer has a new contest with the same contestId but with a different implementation then anyone could call deployProxyAndDistributeBySignature for the new contest without the organizer giving out a new signature. The organizer must have given out a signature on a previous contest with the same contestId and distribute data.

Impact

A malicious user could use the organizer's old signature to deploy and distribute a proxy with the old contest's data potentially resulting in a loss of funds for the organizer.

Tools Used

Manual

Recommendations

ContestIds should always be unique.