Summary

The _distribute function does not check if any of the winners are present more than once.

Vulnerability Details

The organizer can easily either do it on purpose to game the system or by mistake adding more than one of the same address to the array when calling the distribute function and sending the winners and the percentage.

Impact

It opens up to a gamefication of the system, since not only the same address can be used multiple times but it can also take more out of the prize since each time the same address appears it gains another piece of the prize.

Tools Used

Manual

Recommendations

Check if the winner already exists for the contest.