Sparkn

Summary

It is possible to reuse the organizers signature in a case of contestId matching for different implementations.

Vulnerability Details

The setContest function only checks if the salt was previosly used. But for the same organizer, the same contestId and a different implementation the salt will be different. In turn the deployProxyAndDistributeBySignature function accepts contestId and data as signed parameters and recovers organizer from the signature to receive a salt. So it is possible to substitute a different implementation and reuse the signature.

Impact

A malicious user can reuse the organizers signature to distribute prizes in the same proportion with the previous contests with the same contestId.

Tools Used

Manual review

Recommendations

I suggest both: using a check in the setContest function, to prevent contestIds matching for the same organizer, and marking digest as already used in the deployProxyAndDistributeBySignature function. Also it is not redundant to add implementation in the digest.