BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Bonus sweep during the correction window can remove value from a later good-faith bounty

Author Revealed upon completion

Root + Impact

Description

  • Normal behavior: flagOutcome() allows the moderator to correct a previously flagged outcome before any claim has started. For good-faith CORRUPTED, the named attacker should receive a bounty equal to the corrected snapshot of staked principal plus accounted bonus.

  • The issue: sweepUnclaimedBonus() can move accounted bonus out of the pool during the same pre-claim correction window without setting claimsStarted. A public caller can sweep tracked bonus after an initial SURVIVED flag, then the moderator can still correct to good-faith CORRUPTED, but the corrected bounty is computed from the depleted totalBonus.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
// Re-flag allowed pre-claim so the moderator can fix a typo'd outcome / attacker before
// any participant locks in the wrong distribution.
@> if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
IAttackRegistry.ContractState state = _observePoolState();
​
if (newOutcome == PoolStates.Outcome.SURVIVED) {
if (goodFaith_ || attacker_ != address(0)) {
revert InvalidGoodFaithParams();
}
@> if (state != IAttackRegistry.ContractState.PRODUCTION && state != IAttackRegistry.ContractState.CORRUPTED) {
revert InvalidOutcome();
}
} else if (newOutcome == PoolStates.Outcome.CORRUPTED) {
...
}
​
bool willBeGoodFaithCorrupted = newOutcome == PoolStates.Outcome.CORRUPTED && goodFaith_;
​
outcome = newOutcome;
goodFaith = goodFaith_;
attacker = attacker_;
@> snapshotTotalStaked = totalEligibleStake;
@> snapshotTotalBonus = totalBonus;
snapshotSumStakeTime = sumStakeTime;
snapshotSumStakeTimeSq = sumStakeTimeSq;
corruptedReserve = newOutcome == PoolStates.Outcome.CORRUPTED ? snapshotTotalStaked + snapshotTotalBonus : 0;
@> bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;
...
}
​
function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
​
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
if (riskWindowStart != 0) {
reserved += snapshotTotalBonus - claimedBonus;
}
}
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
if (amount == 0) revert NothingToSweep();
​
@> if (totalEligibleStake == 0 || riskWindowStart == 0) {
@> totalBonus -= amount <= totalBonus ? amount : totalBonus;
@> }
​
@> // Intentionally does NOT set claimsStarted.
@> stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • Occurs when the moderator first flags SURVIVED while the live registry is already CORRUPTED, leaving the outcome inside the pre-claim correction window.

  • Occurs when the pool has tracked bonus with zero eligible stake, or no observed risk window, making the bonus unreserved and sweepable before the correction.

Impact:

  • A public caller can reduce or eliminate the bonus component of a later corrected good-faith corrupted bounty.

  • In a bonus-only pool, the corrected bountyEntitlement can become zero even though the pool held tracked bonus before the public sweep.

Proof of Concept

PoC command:

forge test --offline --match-path test/poc/BonusSweepBeforeGoodFaithCorrectionPoC.t.sol

Complete runnable PoC:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
​
contract BonusSweepBeforeGoodFaithCorrectionPoC is BaseConfidencePoolTest {
function testPoC_bonusSweepRemovesValueFromLaterGoodFaithCorrection() external {
address protocol = recovery;
address whitehat = attacker;
address bonusContributor = carol;
address publicCaller = dave;
​
uint256 bonus = 50 * ONE;
​
_contributeBonus(bonusContributor, bonus);
assertEq(pool.totalBonus(), bonus, "setup: tracked bonus funded");
assertEq(pool.totalEligibleStake(), 0, "setup: no stakers");
assertEq(token.balanceOf(address(pool)), bonus, "setup: pool holds the bonus");
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
assertEq(uint256(pool.outcome()), uint256(PoolStates.Outcome.SURVIVED), "setup: wrong outcome still correctable");
assertFalse(pool.claimsStarted(), "setup: correction window is open");
​
vm.prank(publicCaller);
pool.sweepUnclaimedBonus();
​
assertEq(token.balanceOf(protocol), bonus, "attack: tracked bonus was swept to recovery");
assertEq(pool.totalBonus(), 0, "attack: tracked bonus accounting was depleted");
assertEq(token.balanceOf(address(pool)), 0, "attack: no bonus remains in the pool");
assertFalse(pool.claimsStarted(), "attack: sweep did not close the correction window");
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, whitehat);
​
assertEq(uint256(pool.outcome()), uint256(PoolStates.Outcome.CORRUPTED), "correction: outcome changed to corrupted");
assertEq(pool.bountyEntitlement(), 0, "impact: corrected bounty excludes swept bonus");
​
vm.prank(whitehat);
vm.expectRevert();
pool.claimAttackerBounty();
}
}

Full output:

Compiling 64 files with Solc 0.8.26
Solc 0.8.26 finished in 5.51s
Compiler run successful!
​
Ran 1 test for test/poc/BonusSweepBeforeGoodFaithCorrectionPoC.t.sol:BonusSweepBeforeGoodFaithCorrectionPoC
[PASS] testPoC_bonusSweepRemovesValueFromLaterGoodFaithCorrection() (gas: 320729)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 710.63µs (141.08µs CPU time)
​
Ran 1 test suite in 1.44ms (710.63µs CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Recommended Mitigation

function sweepUnclaimedBonus() external nonReentrant {
...
if (totalEligibleStake == 0 || riskWindowStart == 0) {
+ claimsStarted = true;
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
- // Intentionally does NOT set claimsStarted.
stakeToken.safeTransfer(recoveryAddress, amount);
}

Alternatively, prevent destructive bonus sweeps while the outcome is still correctable, or track swept accounted bonus separately and include it in a later good-faith CORRUPTED correction.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!