BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

sweepUnclaimedBonus can underpay corrected good-faith CORRUPTED bounty

Author Revealed upon completion

Root + Impact

Description

flagOutcome() intentionally allows a moderator to re-flag before the first claim so a typo or wrong outcome can be corrected. claimsStarted is meant to be the value-movement finality latch.

However, sweepUnclaimedBonus() can move real bonus value to recoveryAddress without setting claimsStarted. In the no-risk-window path (riskWindowStart == 0), the function treats the whole bonus as unreserved, decrements totalBonus, and transfers it out while the re-flag window remains open.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
...
snapshotTotalStaked = totalEligibleStake;
snapshotTotalBonus = totalBonus;
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;
}
​
function sweepUnclaimedBonus() external nonReentrant {
...
if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
// Intentionally does NOT set claimsStarted.
stakeToken.safeTransfer(recoveryAddress, amount);
}

After a mistaken SURVIVED flag, anyone can sweep the bonus. The moderator can still correct to good-faith CORRUPTED, but flagOutcome() snapshots the already-reduced totalBonus, so the named attacker bounty excludes the swept bonus. This contradicts the documented rule that value movement finalizes distribution because a later corrective re-flag cannot be honored without breaking accounting.

Risk

Likelihood:

  • Requires a terminal-CORRUPTED pool with riskWindowStart == 0 and an initial mistaken SURVIVED flag.

  • The exploit step is permissionless: any public caller can call sweepUnclaimedBonus() before the moderator correction.

  • The moderator-error precondition makes likelihood low, but this is still in-model because pre-claim re-flagging exists specifically to recover from typo/outcome mistakes.

Impact:

  • Good-faith attacker bounty is underpaid by the swept bonus amount.

  • Bonus funds are sent to recoveryAddress under the stale SURVIVED accounting before the intended CORRUPTED correction can be honored.

  • The documented finality invariant is broken: value leaves the contract while claimsStarted remains false.

Proof of Concept

Add this test under test/unit/CodexScratch.reflag.t.sol and run:

forge test --match-path test/unit/CodexScratch.reflag.t.sol -vvv
// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
​
contract CodexScratchReflagTest is BaseConfidencePoolTest {
function test_noRiskSurvivedBonusSweepThenGoodFaithCorruptedReflagIsPrincipalOnly() external {
_stake(alice, 100 * ONE);
_contributeBonus(carol, 50 * ONE);
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery), 50 * ONE, "bonus swept before reflag");
assertEq(pool.totalBonus(), 0, "bonus removed from live accounting");
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
assertEq(pool.bountyEntitlement(), 100 * ONE, "bounty excludes swept bonus");
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), 100 * ONE, "attacker receives principal only");
}
}

Expected good-faith CORRUPTED entitlement before the sweep is 150 * ONE (principal + bonus). After the sweep and re-flag, entitlement is only 100 * ONE.

Local result: the PoC passes. I also ran a control test with riskWindowStart != 0; that path reserves the real bonus and only sweeps donations, confirming the issue is isolated to the no-risk-window bonus sweep.

Recommended Mitigation

If sweepUnclaimedBonus() moves value that came from totalBonus / snapshotTotalBonus, mark the current outcome final by setting claimsStarted = true. Donation-only dust sweeps can remain non-final if needed.

if (totalEligibleStake == 0 || riskWindowStart == 0) {
- totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ uint256 realBonusSwept = amount <= totalBonus ? amount : totalBonus;
+ totalBonus -= realBonusSwept;
+ if (realBonusSwept != 0 && !claimsStarted) claimsStarted = true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!