BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Attacker Bounty Underfunded After Pre-Claim Sweep via sweepUnclaimedBonus()

Author Revealed upon completion

Description

  • ConfidencePool allows the moderator to correct a typo'd outcome before any participant claims (claimsStarted = false). However, sweepUnclaimedBonus() can be called in this same window — it sweeps the bonus to recoveryAddress AND sets totalBonus = 0, but intentionally does NOT set claimsStarted = true.

    If the moderator then re-flags to good-faith CORRUPTED, flagOutcome() snapshots the current totalBonus (now 0) to calculate bountyEntitlement:

    bountyEntitlement = snapshotTotalStaked + snapshotTotalBonus = stake + 0

    The whitehat attacker receives only the staked principal — the entire bonus pool has been permanently sent to recoveryAddress and is unrecoverable.

// sweepUnclaimedBonus() — sets totalBonus = 0 but NOT claimsStarted
if (totalEligibleStake == 0 || riskWindowStart == 0) {
// @> totalBonus depleted to 0
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
// @> claimsStarted intentionally NOT set — re-flag window stays open
​
// flagOutcome() — snapshots depleted totalBonus
snapshotTotalBonus = totalBonus; // @> = 0 after sweep
bountyEntitlement = snapshotTotalStaked + snapshotTotalBonus; // @> = stake + 0
​

Risk

Likelihood:

  • Requires moderator to flag wrong outcome first (typo/mistake)

  • sweepUnclaimedBonus() must be called before the correction

  • Moderator must then re-flag to good-faith CORRUPTED

  • Sequence is rare but realistic in production

Impact:

  • Whitehat attacker receives only staked principal, losing entire bonus

  • In a $100K bonus pool: whitehat loses$100,000 permanently

  • Bonus tokens are sent to recoveryAddress and cannot be reclaimed

  • Verified: 90% bounty loss in Scenario 3 (10,000 received vs 110,000 owed)

Proof of Concept

Run: forge test --match-test test_M02_Scenario3_LargePool_EconomicImpact -vvv

Attack steps:

  1. Alice stakes 10,000 tokens, Carol contributes 100,000 bonus

  2. Moderator flags SURVIVED (no risk window — riskWindowStart = 0)

  3. Anyone calls sweepUnclaimedBonus() — sweeps 100,000 tokens to recoveryAddress, totalBonus = 0

  4. Moderator re-flags to good-faith CORRUPTED (allowed: claimsStarted = false)

  5. bountyEntitlement = 10,000 + 0 = 10,000 (instead of 110,000)

  6. Whitehat receives 10,000 tokens — loses 100,000 tokens (90%)

function test_M02_Scenario3_LargePool_EconomicImpact() public {
uint256 stakeAmount = 10_000 ether;
uint256 bonusAmount = 100_000 ether;
​
_stake(pool, alice, stakeAmount);
_bonus(pool, carol, bonusAmount);
​
// Flag SURVIVED (no risk window)
attackRegistry.setAgreementState(IAttackRegistry.ContractState.PRODUCTION);
vm.prank(moderatorAddr);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
// Sweep depletes totalBonus to 0
pool.sweepUnclaimedBonus();
​
// Re-flag to CORRUPTED — bountyEntitlement snapshots depleted totalBonus
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
vm.prank(moderatorAddr);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, whitehat);
​
// Whitehat receives 10,000 instead of 110,000 — loses 100,000 tokens (90%)
assertEq(pool.bountyEntitlement(), stakeAmount);
}
​

Forge output:

Fair bounty: 110,000 tokens
Actual bounty: 10,000 tokens
Whitehat LOST: 100,000 tokens (90%)
​

Recommended Mitigation

sweepUnclaimedBonus() should set claimsStarted = true when sweeping
a non-zero amount. A sweep is a value-movement event that permanently
removes tokens from the pool — it should close the moderator's re-flag
window exactly like a claim does.

- stakeToken.safeTransfer(recoveryAddress, amount);
+ if (amount > 0) {
+ claimsStarted = true;
+ stakeToken.safeTransfer(recoveryAddress, amount);
+ }
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!