Sparkn

Summary

The contract does zero address checks for almost all passed parameters. But there is no 0 address check for the addresses in the winners array. This can lead to the contract sending funds to unrecoverable addresses.

Vulnerability Details

The contract does a 0 address check on the passed token variable in the _distribute function.

This check is also present in the FACTORY_ADDRESS and STADIUM_ADDRESS variables. However, no such check is present on the winners array. This can lead to the contract sending funds to unrecoverable addresses by mistake.

Impact

Funds sent to irrecoverable addresses.

Tools Used

Manual Review

Recommendations

Add a 0 address check for the winners array.