Summary

The Distributor.sol contract contains a potential gas limit vulnerability that arises from the use of a loop to transfer tokens to an array of addresses.

Vulnerability Details

In the _distribute() function, a for loop is used to distribute the rewards to each winner in the array.

The size of the array winners[] and percentages[] is unspecified. It's possible that this function could require more gas than the block limit to complete its execution.

Impact

The transaction may fail due to a large amount of winners and funds will be stuck inside the Proxy contract since there is no function to withdraw tokens that doesn’t rely on _distribute() logic.

Tools Used

Manual review

Recommendations

Implement a claim() function to allow winners to claim their rewards, reducing gas cost or alternatively add a require statement that checks winners.length e.g.