BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

sweepUnclaimedBonus can be used to drain the bonus before a CORRUPTED re-flag, cheating the whitehat out of their bounty

Author Revealed upon completion

Root + Impact

Description

sweepUnclaimedBonus intentionally skips claimsStarted to keep the moderator's re-flag window
open. When riskWindowStart == 0 it also decrements totalBonus to zero. On a subsequent
re-flag to good-faith CORRUPTED, flagOutcome re-snapshots snapshotTotalBonus = totalBonus,
reading zero. bountyEntitlement becomes snapshotTotalStaked + 0 instead of
snapshotTotalStaked + B, permanently stranding bonus B at recoveryAddress and contradicting
DESIGN.md §12's guarantee that the entire pool is the attacker's bounty.

// ConfidencePool.sol::sweepUnclaimedBonus
// @> totalBonus zeroed out here while claimsStarted stays false
if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus; // @> totalBonus = 0
}
// @> claimsStarted intentionally NOT set, re-flag window remains open
​
// ConfidencePool.sol::flagOutcome (on re-flag)
// @> re-snapshots live totalBonus, which is now 0 after the sweep
snapshotTotalBonus = totalBonus; // @> reads 0 instead of B
bountyEntitlement = willBeGoodFaithCorrupted
? snapshotTotalStaked + snapshotTotalBonus // @> S + 0 instead of S + B
: 0;

Risk

Likelihood:

  • riskWindowStart stays zero if no pool interaction occurred during UNDER_ATTACK; pokeRiskWindow cannot retroactively seal it because _isActiveRiskState(CORRUPTED) is false.

  • Moderator incorrectly flagging SURVIVED on a CORRUPTED registry is the exact mistake DESIGN.md §4 acknowledges the re-flag window exists to correct.

  • sweepUnclaimedBonus is permissionless; the sponsor controls recoveryAddress and receives B directly, giving them financial incentive to call it the moment the wrong flag lands.

Impact:

  • The named whitehat receives only snapshotTotalStaked instead of the full snapshotTotalStaked + snapshotTotalBonus. Bonus B is permanently transferred to the sponsor's recoveryAddress with no recovery path.

Proof of Concept

Alice and Bob stake 150 total; Carol contributes 40 bonus. Registry reaches CORRUPTED with
riskWindowStart == 0. Moderator flags SURVIVED; sponsor sweeps the 40-token bonus to
recoveryAddress, zeroing totalBonus. Moderator corrects to good-faith CORRUPTED but the
re-snapshot reads totalBonus = 0, so bountyEntitlement is 150 instead of 190. Attacker
receives 150; sponsor keeps 40.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
​
// forge test --match-test testPoc_SweepBonusBeforeReflagShortchangesAttacker -vvvv
contract SweepBonusCorruptedReflagPoC is BaseConfidencePoolTest {
function testPoc_SweepBonusBeforeReflagShortchangesAttacker() external {
uint256 S = 150 * ONE;
uint256 B = 40 * ONE;
​
_stake(alice, 100 * ONE);
_stake(bob, 50 * ONE);
_contributeBonus(carol, B);
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
assertEq(pool.riskWindowStart(), 0);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
assertEq(pool.snapshotTotalBonus(), B);
assertEq(pool.claimsStarted(), false);
​
uint256 recoveryBefore = token.balanceOf(recovery);
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery) - recoveryBefore, B);
assertEq(pool.totalBonus(), 0);
assertEq(pool.claimsStarted(), false);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.snapshotTotalBonus(), 0); // should be B
assertEq(pool.bountyEntitlement(), S); // should be S + B
​
vm.prank(attacker);
pool.claimAttackerBounty();
​
assertEq(token.balanceOf(attacker), S); // missing B
assertEq(token.balanceOf(recovery) - recoveryBefore, B); // sponsor kept B
assertEq(token.balanceOf(address(pool)), 0);
}
}

Recommended Mitigation

On a re-flag, keep the existing snapshotTotalBonus instead of re-reading totalBonus.
Stakes and sums can legitimately change between flags, but totalBonus can only be depleted
by a sweep that bypasses claimsStarted, so it must not be re-read on correction.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
+ bool isReflag = outcome != PoolStates.Outcome.UNRESOLVED;
IAttackRegistry.ContractState state = _observePoolState();
​
// ... validation ...
​
outcome = newOutcome;
goodFaith = goodFaith_;
attacker = attacker_;
snapshotTotalStaked = totalEligibleStake;
- snapshotTotalBonus = totalBonus;
+ snapshotTotalBonus = isReflag ? snapshotTotalBonus : totalBonus;
snapshotSumStakeTime = sumStakeTime;
snapshotSumStakeTimeSq = sumStakeTimeSq;
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Appeal created

Hawk 1 Submitter
2 days ago

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!