BattleChain Confidence Pools

​

A permissionless `sweepUnclaimedBonus()` between a moderator's `SURVIVED` flag and a corrective `CORRUPTED` re-flag irreversibly drains the bonus to `recoveryAddress`, permanently reducing the whitehat attacker's bounty. The protocol pays the wrong recipient with no recovery path.

​

​

`sweepUnclaimedBonus` does not set `claimsStarted` (L503), so the re-flag window stays open after the sweep. When `riskWindowStart == 0`, bonus is unreserved and fully sweepable (L483-487). On re-flag, the snapshot captures the now-zeroed `totalBonus` (L358), producing a reduced `bountyEntitlement`:

​

// ConfidencePool.sol L357-362

snapshotTotalBonus = totalBonus; // captures zeroed value after sweep

bountyEntitlement = willBeGoodFaithCorrupted

​

Because the snapshot occurs after the sweep, no later code path restores the swept bonus into `bountyEntitlement`.

​

**Reachability of `riskWindowStart == 0`:** The registry requires `UNDER_ATTACK` before `CORRUPTED` (`AttackRegistry.sol` L324). But the pool only seals `riskWindowStart` on a pool-touching transaction (L793). If `approveAttack()` and `markCorrupted()` execute with no pool interaction in between (e.g., same block), `riskWindowStart` stays zero.

​

​

​

1. Registry reaches `CORRUPTED` with no pool interaction during `UNDER_ATTACK` — `riskWindowStart` stays zero.

2. Moderator flags `SURVIVED`. No call to `stake()`, `contributeBonus()`, or `pokeRiskWindow()` occurred during the active-risk interval.

3. Anyone calls `sweepUnclaimedBonus()` — bonus drains to `recoveryAddress`, `totalBonus` zeroed.

4. `claimsStarted` remains false — moderator re-flags to good-faith `CORRUPTED`.

5. `bountyEntitlement = snapshotTotalStaked + 0`. Attacker permanently loses the bonus portion.

​

​

**Impact: High** — The protocol permanently pays the wrong recipient. The bonus (up to 100% of `totalBonus`) is irreversibly sent to `recoveryAddress` instead of the named whitehat attacker. The loss is bounded only by the bonus pool size and is independent of the attacker's exploit performance.

​

**Likelihood: Medium** — Requires a rare but valid registry path where the pool does not observe the active-risk window before `CORRUPTED`, combined with a moderator flag correction. The sweep is permissionless and trivially automatable by a MEV bot.

​

​

The whitehat attacker permanently loses their bonus entitlement. In the PoC, the attacker receives 150 tokens instead of the expected 200 — a 25% loss. The swept bonus sits irreversibly at `recoveryAddress`. No re-flag, no subsequent call, and no admin action can restore it into the attacker's `bountyEntitlement`.

​

​

Drop into `test/unit/` and run: `forge test --match-test testSweepBetweenFlagsReducesAttackerBounty -vvvv`

​

The PoC uses `MockAttackRegistry` (same test double used by all 256 official tests) to stage the `CORRUPTED` state. In production this is reached via `approveAttack()` → `markCorrupted()` with no pool interaction in between.

​

// SPDX-License-Identifier: MIT

pragma solidity 0.8.26;

​

import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";

import {PoolStates} from "src/libraries/PoolStates.sol";

import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";

​

contract PoC_SweepDrainsBounty is BaseConfidencePoolTest {

​

​

​

​

​

}

​

Manual review, Foundry

​

Gate `sweepUnclaimedBonus` on `claimsStarted`:

​

function sweepUnclaimedBonus() external nonReentrant {

+ if (!claimsStarted) revert OutcomeNotEligibleForSweep();

Alternatively, freeze `totalBonus` at the first `flagOutcome` and never re-snapshot it on re-flag, decoupling the sweep's accounting from the re-flag's snapshot.

​