BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Bonus sweep can reduce a corrected attacker bounty

Author Revealed upon completion

Description

Before the first claim, the moderator can correct an incorrectly flagged outcome or attacker. The pool should preserve enough value to honor every outcome that remains selectable during that correction window.

sweepUnclaimedBonus() can remove tracked bonus while claimsStarted remains false. A later correction from SURVIVED or EXPIRED to good-faith CORRUPTED snapshots the reduced totalBonus, so the named attacker receives less than the pool held before the permissionless sweep.

function flagOutcome(
PoolStates.Outcome newOutcome,
bool goodFaith_,
address attacker_
) external onlyModerator {
// @> Reflagging remains allowed until a claim sets claimsStarted.
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) {
revert OutcomeAlreadySet();
}
​
// @> A correction snapshots totalBonus after a sweep has reduced it.
snapshotTotalBonus = totalBonus;
bountyEntitlement = willBeGoodFaithCorrupted
? snapshotTotalStaked + snapshotTotalBonus
: 0;
}
​
function sweepUnclaimedBonus() external nonReentrant {
if (totalEligibleStake == 0 || riskWindowStart == 0) {
// @> The permissionless sweep removes tracked bonus.
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
// @> No finality flag is set, so the moderator can still reflag.
stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • This occurs when tracked bonus exists, a SURVIVED or EXPIRED result makes it sweepable, and the moderator later corrects the result to good-faith CORRUPTED.

  • Any address can execute the sweep and can front-run a visible moderator correction.

Impact:

  • Up to the entire tracked bonus can be redirected from the attacker to recoveryAddress.

  • The correction succeeds but snapshots an underfunded bounty even though the pool held the missing value immediately before the sweep.

Proof of Concept

Place PoC.t.sol in test/ and run:

forge test test/PoC.t.sol -vvv
function test_BonusSweep() external {
_stake(alice, 100 ether);
_contributeBonus(carol, 50 ether);
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
uint256 recoveryBefore = token.balanceOf(recovery);
vm.prank(dave);
pool.sweepUnclaimedBonus();
​
assertEq(token.balanceOf(recovery) - recoveryBefore, 50 ether);
assertFalse(pool.claimsStarted());
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
assertEq(pool.snapshotTotalBonus(), 0);
assertEq(pool.bountyEntitlement(), 100 ether);
​
vm.prank(attacker);
pool.claimAttackerBounty();
​
assertEq(token.balanceOf(attacker), 100 ether);
}

Recommended Mitigation

Reserve all tracked bonus while the outcome remains re-flaggable. Permit only untracked excess balance to be swept before distribution finality. Add an explicit finalization mechanism when a no-claimer pool needs a liveness path.

function sweepUnclaimedBonus() external nonReentrant {
- uint256 reserved;
- if (totalEligibleStake != 0) {
- reserved = totalEligibleStake;
- if (riskWindowStart != 0) {
- reserved += snapshotTotalBonus - claimedBonus;
- }
- }
+ uint256 reserved = totalEligibleStake;
+
+ if (!claimsStarted) {
+ reserved += totalBonus;
+ } else if (totalEligibleStake != 0 && riskWindowStart != 0) {
+ reserved += snapshotTotalBonus - claimedBonus;
+ }
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
if (amount == 0) revert NothingToSweep();
​
- if (totalEligibleStake == 0 || riskWindowStart == 0) {
+ if (claimsStarted && (totalEligibleStake == 0 || riskWindowStart == 0)) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
stakeToken.safeTransfer(recoveryAddress, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!