The _to address is arbitrary parameter and lacks zero address check.
The arbitrary parameter can lead to sending ETH to the wrong address, like the zero address.
This may not be intended but will lead to loss of funds.
Manual Review
Implement the following check:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.