FoundrySolidityLayer 2
7.25 ETH
Submission Details
Impact: low
Likelihood: medium
Invalid

`_clampUserSums()` Called Unnecessarily in `withdraw()` Always a No-Op

Author Revealed upon completion

Summary

withdraw() calls _clampUserSums(msg.sender) but this call always returns immediately without doing anything. The withdraw gate already guarantees riskWindowStart == 0 before execution reaches that line, and _clampUserSums returns early when riskWindowStart == 0. The call is a dead code path that only wastes gas.

Root Cause

withdraw() gate ensures riskWindowStart == 0:

function withdraw() external nonReentrant {
...
if (
riskWindowStart != 0 // reverts if riskWindowStart != 0
|| (...)
) {
revert WithdrawsDisabled();
}
// If we reach here: riskWindowStart is ALWAYS 0
_clampUserSums(msg.sender); // pointless call
}

_clampUserSums immediately returns when riskWindowStart == 0:

function _clampUserSums(address u) internal {
uint256 start = riskWindowStart;
uint256 stake_ = eligibleStake[u];
if (start == 0 || stake_ == 0) return; // ALWAYS hits this when called from withdraw()
// never reaches here from withdraw()
...
}

Code snippet-
https://github.com/CodeHawks-Contests/2026-07-bc-confidence-pools/blob/58e8ba4ce3f3277866e4926f3140e597f9554a1e/src/ConfidencePool.sol#L305

Impact

Wastes gas on every withdrawal (extra SLOAD for riskWindowStart).

Fix

Simply remove the unnecessary call.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

QA / Informational / Gas

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

QA / Informational / Gas

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!