BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Permanent reduction of Attacker Bounty due to `sweepUnclaimedBonus` during the re-flag window

Author Revealed upon completion

Root + Impact

The sweepUnclaimedBonus function allows the permanent removal of tracked bonus funds from the pool without triggering the claimsStarted finality latch. This enables a race condition where a temporary incorrect outcome allows third parties to deplete the bonus pool, irrevocably reducing the bounty entitlement for a subsequent corrected CORRUPTED outcome.

Description

The protocol implements a flagOutcome function that allows the moderator to correct a previously set outcome as long as no participant has acted upon it. This finality is tracked via the claimsStarted flag.

The sweepUnclaimedBonus function is designed to recover excess funds (donations/dust) to the recoveryAddress. However, when an outcome is set to SURVIVED, this function treats the entire totalBonus as "unclaimed" if riskWindowStart is zero. Because sweepUnclaimedBonus explicitly does not set claimsStarted to true, it allows for the movement of value while leaving the re-flag window open. If a moderator incorrectly flags an agreement as SURVIVED and a sweep occurs before the correction to CORRUPTED, the totalBonus is permanently lost to the recoveryAddress, and the attacker’s bounty (which is snapshotted during the re-flag) is significantly reduced.

function sweepUnclaimedBonus() external nonReentrant {
// ... logic to calculate amount ...
if (totalEligibleStake == 0 || riskWindowStart == 0) {
@> totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
@> // Intentionally does NOT set claimsStarted.
stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • Occurrence happens during the interval between an accidental SURVIVED flag (permitted even if registry is CORRUPTED) and the moderator's corrective CORRUPTED flag.

  • External observers or MEV bots monitor the OutcomeFlagged event and trigger sweepUnclaimedBonus immediately to redirect funds.

Impact:

  • Permanent loss of bonus funds intended for the whitehat attacker.

  • Breach of the protocol's core incentive alignment, as the "Good Faith" bounty becomes underfunded.

Proof of Concept

function test_PoC_SweepBonusReducesBounty() public {
_stake(alice, 100 * ONE); _contributeBonus(bob, 50 * ONE);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
pool.pokeRiskWindow();
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
pool.sweepUnclaimedBonus(); // Maliciously sweeps the 50 ONE bonus
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.bountyEntitlement(), 100 * ONE); // Should have been 150
}

Recommended Mitigation

if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
- // Intentionally does NOT set claimsStarted.
+ if (amount > 0 && !claimsStarted) claimsStarted = true;
stakeToken.safeTransfer(recoveryAddress, amount);
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!