Sparkn

Summary

If there are too many winners, the transaction will exceed the block gas limit, especially on chains with lower block gas limits, the organizer can't distribute funds or split transactions due to contract and percentage constraints.

Vulnerability Details

If there are too many winners, the organizer will be unable to distribute all of the funds to all of the winners, since the transaction will hit the block gas limit. The block gas limit will vary between EVM chains. For example, Avalanche has a lower block gas limit, which will allow a significantly lower amount of winners.

The organizer also can not split the distribution across multiple transactions, as two things will happen:

1. The organizer can not call deployProxyAndDistribute a second time, since it will revert, as there is already a contract deployed at the same address

2. The actual percentages array can not be split across multiple transactions, since the sum of all elements in the array must equal 10000 - COMMISSION_FEE, and splitting the array would cause this to fail.

Impact

In contests where a large number of winners are possible (audit contest for example), the organizer will be unable to distribute all funds to all applicable winners. Therefore they are forced to not pay out all of the winners.

Tools Used

Manual analysis

Recommendations

Instead of trying to transfer the funds to each address, store in a state variable how many funds each address can withdraw and then create a withdraw function, where each participant can withdraw the funds their own. Push over pull.