Frontrunning distribute functions

[code423n4]

Handle

pauliax

Vulnerability details

Impact

distribute and distributeOther can be frontrunned. Anyone can call these functions and receive callIncentive. A frontrunner can watch the mempool and copy the calldata to replicate the same tx. For example, a frontrunner calculates that replicating this tx will result in profit, he watches and copies the tx, then instantly sell these received incentives on AMM for profit. This may result in reverted txs, gas wasted, and a poor experience for legit users.

Recommended Mitigation Steps

This problem seems insurmountable in this case but you may want to consider adding restrictions on the callers or introducing any other possible prevention techniques.