BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Unlatched `sweepUnclaimedBonus` strands the bonus during the pre-claim re-flag window, underpaying the whitehat by the entire bonus.

Author Revealed upon completion

Root + Impact

Description

  • Normally, a good-faith CORRUPTED resolution pays the named whitehat the entire pool (principal + bonus) as bounty (DESIGN.md §12), and resolution finality is protected by the invariant "claimsStarted == true ⇒ value has moved, so a corrective re-flag is only safe until then" (§4) — every value-moving entrypoint latches claimsStarted.

  • sweepUnclaimedBonus deliberately does not latch claimsStarted (to defeat 1-wei donation griefing), but in the riskWindowStart == 0 branch it also performs a genuine, irreversible value movement: it exports the entire bonus to recoveryAddress and zeroes totalBonus. Because finality is never latched, the outcome stays re-flaggable after the bonus has left the pool; a subsequent good-faith CORRUPTED re-flag re-snapshots the bounty against a totalBonus that has already been drained to 0, so the bounty silently excludes the bonus.

function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
​
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
@> if (riskWindowStart != 0) {
@> reserved += snapshotTotalBonus - claimedBonus; // skipped when riskWindowStart == 0 => bonus NOT reserved
}
}
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0; // == full bonus when unreserved
if (amount == 0) revert NothingToSweep();
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
@> totalBonus -= amount <= totalBonus ? amount : totalBonus; // live totalBonus zeroed
}
​
@> // Intentionally does NOT set claimsStarted <-- ROOT CAUSE: value moves, finality NOT latched
stakeToken.safeTransfer(recoveryAddress, amount); // bonus irreversibly leaves the pool
}

Risk

Likelihood:

  • Occurs whenever the registry reaches terminal CORRUPTED without the pool ever observing an active-risk state (no pokeRiskWindow and no gated call during the UNDER_ATTACK/PROMOTION_REQUESTED interval), leaving riskWindowStart == 0.

  • Occurs when the moderator first flags SURVIVED on that CORRUPTED registry — an explicitly valid "out-of-scope breach" judgement that does not latch claimsStarted — and later uses the documented pre-claim re-flag (§4) to correct to good-faith CORRUPTED.

  • Occurs on the interleaving permissionless sweepUnclaimedBonus call, which the recoveryAddress beneficiary (the bonus sponsor) is directly incentivized to make; no malicious moderator and no special privilege are required.

  • Impact:

  • The named whitehat is underpaid by exactly the bonus amount: the bounty is re-snapshotted as principal-only, violating the DESIGN §12 guarantee that the whole pool is the bounty.

  • The entire bonus is permanently stranded at recoveryAddress (the sponsor) with no recovery path, and the resolution-finality invariant (§4) is broken because value moved while the outcome remained re-flaggable.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
​
contract BonusStrandingReflagTest is BaseConfidencePoolTest {
uint256 internal constant PRINCIPAL = 100 * ONE;
uint256 internal constant BONUS = 50 * ONE;
​
function test_poc_bonusStrandedByReflagAfterSweep() external {
// 1. Alice stakes principal; a sponsor contributes bonus. Registry is in pre-attack
// staging (NEW_DEPLOYMENT), so deposits are allowed and riskWindowStart stays 0.
_stake(alice, PRINCIPAL);
_contributeBonus(makeAddr("sponsorBonus"), BONUS);
assertEq(pool.totalEligibleStake(), PRINCIPAL);
assertEq(pool.totalBonus(), BONUS);
assertEq(token.balanceOf(address(pool)), PRINCIPAL + BONUS);
​
// 2. Registry reaches terminal CORRUPTED, but the pool never observed an active-risk
// state, so the risk window never opened (riskWindowStart == 0).
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
// 3. Moderator (mistakenly) flags SURVIVED — valid on a CORRUPTED registry, and does
// NOT latch claimsStarted.
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
assertEq(pool.riskWindowStart(), 0);
assertEq(pool.claimsStarted(), false);
​
// 4. Permissionless sweep. riskWindowStart == 0 => bonus unreserved => full BONUS exported
// to recoveryAddress, totalBonus zeroed, claimsStarted still false (root cause).
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery), BONUS);
assertEq(token.balanceOf(address(pool)), PRINCIPAL);
assertEq(pool.totalBonus(), 0);
assertEq(pool.claimsStarted(), false);
​
// 5. Moderator corrects to good-faith CORRUPTED (allowed: claimsStarted == false).
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// Bounty re-snapshotted against depleted totalBonus (== 0) => excludes the bonus.
assertEq(pool.bountyEntitlement(), PRINCIPAL);
​
// 6. Whitehat claims full entitlement — principal only.
vm.prank(attacker);
pool.claimAttackerBounty();
​
assertEq(token.balanceOf(attacker), PRINCIPAL); // underpaid by exactly BONUS
assertEq(token.balanceOf(recovery), BONUS); // bonus stranded with sponsor
assertEq(token.balanceOf(address(pool)), 0);
}
​
// Control: direct good-faith CORRUPTED (no SURVIVED detour, no interleaved sweep) pays the
// whole pool — the DESIGN §12 behavior. Same funds; only the sequence differs.
function test_control_directGoodFaithCorruptedPaysWholePool() external {
_stake(alice, PRINCIPAL);
_contributeBonus(makeAddr("sponsorBonus"), BONUS);
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
assertEq(pool.bountyEntitlement(), PRINCIPAL + BONUS);
​
vm.prank(attacker);
pool.claimAttackerBounty();
​
assertEq(token.balanceOf(attacker), PRINCIPAL + BONUS);
assertEq(token.balanceOf(recovery), 0);
}
}

Recommended Mitigation

Latch finality only when the sweep moves genuine bonus, preserving the anti-griefing property for
dust/donation sweeps:
if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ claimsStarted = true; // genuine bonus left the pool — lock the outcome
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!