Root + Impact

Description

After the pool has passed expiry, a staker can still exit through withdraw() before the pool is mechanically resolved through claimExpired().

This creates two different post-expiry routes for the same unresolved no-risk state:

• withdraw() removes the staker and pays principal only;

• claimExpired() later resolves the pool and the remaining bonus can become recoverable through the sweep path.

Affected route:

• withdraw()

• claimExpired()

• sweepUnclaimedBonus()

The issue is that the post-expiry settlement boundary is not closed before the pre-risk withdraw path remains available. This allows a staker to be removed from accounting after expiry but before mechanical resolution.

Risk

Likelihood

Medium.

This can occur when the pool is expired, the registry is still in a pre-risk state, and a staker calls withdraw() before anyone calls claimExpired().

Impact

Medium.

The same expired unresolved pool state can produce different bonus treatment depending on which route is called first.

A staker can exit with principal only, while the bonus remains outside that staker's settlement path and can later become recoverable. This creates a settlement-ordering inconsistency between post-expiry withdrawal and mechanical expiration resolution.

Proof of Concept

This PoC proves that after expiry, a staker can still use withdraw() before claimExpired() finalizes the pool. The staker receives principal only, is removed from accounting, and the bonus remains outside that staker's settlement path.

Steps to reproduce

1. A staker deposits into the pool.

2. A bonus is contributed.

3. The pool reaches expiry.

4. The registry remains in a pre-risk state.

5. The staker calls withdraw() before claimExpired().

6. The staker receives principal only.

7. The staker is removed from accounting.

8. The bonus remains in the pool and can later become recoverable.

Relevant code path

Test code

Command

Observed output

What the PoC proves

Before mechanical expiration resolution:

After post-expiry withdraw:

This proves that the post-expiry withdraw route can change the final accounting path before the pool is mechanically resolved.

Recommended Mitigation

The pool should preserve a consistent settlement boundary after expiry.

A safe fix should ensure that withdrawal and expiration-resolution routes cannot produce inconsistent accounting outcomes for the same expired unresolved state.

A regression test should cover an expired unresolved pool where a staker attempts to withdraw before mechanical expiration resolution.