BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

`sweepUnclaimedBonus` strips the whitehat's bonus after a SURVIVED to good-faith CORRUPTED re-flag

Author Revealed upon completion

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

## Description
​
`sweepUnclaimedBonus` reserves the principal still owed to stakers, then sweeps the surplus to `recoveryAddress`. When `riskWindowStart == 0`, `_bonusShare` returns 0 for every staker, so the bonus is treated as unowed and the bonus-reserve line is skipped:
​
```solidity
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
if (riskWindowStart != 0) {
reserved += snapshotTotalBonus - claimedBonus;
}
}
```
​
With the bonus unreserved, the full bonus `B` is swept and `totalBonus` is decremented to 0:
​
```solidity
if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
```
​
This branch intentionally does not set `claimsStarted`:
​
```solidity
// Intentionally does NOT set claimsStarted. A direct-transfer donation of as little as 1
// wei would otherwise let anyone flip the flag post-flagOutcome and block the moderator's
// documented pre-claim re-flag window. Genuine reliance only comes from claim entrypoints.
stakeToken.safeTransfer(recoveryAddress, amount);
```
​
Because `claimsStarted` stays false, the re-flag gate in `flagOutcome` still passes:
​
```solidity
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
```
​
A moderator who now issues a good-faith CORRUPTED correction re-snapshots the live `totalBonus`, which is 0, and prices the bounty off principal only:
​
```solidity
snapshotTotalBonus = totalBonus;
```
​
```solidity
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;
```
​
The whitehat's `claimAttackerBounty` pays `snapshotTotalStaked` alone. The bonus `B` already left the pool to `recoveryAddress` and can never be recovered by the whitehat. DESIGN.md promises the good-faith CORRUPTED whitehat the whole pool, stake plus bonus. The bounty is not gated on `riskWindowStart`, unlike `_bonusShare`, so this re-pricing is silent.
​
## Example
​
Pool holds principal S = 5000e18 from active stakers and accumulated bonus B = 1000e18. The active-risk window was never observed on-chain, so `riskWindowStart == 0`.
​
1. The registry reaches a terminal state and the moderator first flags SURVIVED, judging the breach out of the pool's scope
2. The sponsor front-runs the moderator's pending correction and calls `sweepUnclaimedBonus`
3. `reserved` covers only the S principal, because the `riskWindowStart != 0` bonus-reserve line is skipped
4. `amount` equals the full bonus B = 1000e18, which transfers to the sponsor-controlled `recoveryAddress`
5. `totalBonus` is decremented to 0, and `claimsStarted` stays false
6. The moderator recognizes the breach was in scope and re-flags good-faith CORRUPTED naming the whitehat
7. The gate in `flagOutcome` passes because `claimsStarted` is false
8. `snapshotTotalBonus` re-reads `totalBonus` as 0, so `bountyEntitlement = 5000e18 + 0`
9. The whitehat calls `claimAttackerBounty` and receives 5000e18, not 6000e18
10. B = 1000e18 is permanently stranded at `recoveryAddress`
​

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

Impact:

  • Impact 1

  • Impact 2

Proof of Concept

​

Recommended Mitigation

Latch finality when accounted bonus actually leaves the pool. A donation never decrements `totalBonus`, so the guard below keeps the 1 wei non-latch intact while closing the re-flag window once real bonus value moves.
​
```diff
if (totalEligibleStake == 0 || riskWindowStart == 0) {
- totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ uint256 dec = amount <= totalBonus ? amount : totalBonus;
+ totalBonus -= dec;
+ // Accounted bonus (not a mere donation) left the pool: lock the outcome so a later
+ // good-faith CORRUPTED re-flag cannot re-price the whitehat's bounty to exclude it.
+ if (dec != 0 && !claimsStarted) claimsStarted = true;
}
```
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!