BattleChain Confidence Pools

Summary

A pool that observed risk but has no eligible stakers can sweep its tracked bonus after a mistaken SURVIVED flag without closing the moderator's re-flag window. If the moderator then corrects the outcome to good-faith CORRUPTED, the corrected bounty snapshot excludes the already-swept bonus, denying the named whitehat the tracked bonus pool.

Description

sweepUnclaimedBonus treats any SURVIVED/EXPIRED pool with totalEligibleStake == 0 as having no outstanding staker reserve, so the whole token balance is sweepable to recoveryAddress even when riskWindowStart != 0 and the balance is protocol-tracked totalBonus. The same function intentionally does not set claimsStarted, leaving flagOutcome's correction window open. On a later correction to good-faith CORRUPTED, flagOutcome snapshots the now-decremented totalBonus and sets the whitehat bounty from snapshotTotalStaked + snapshotTotalBonus.

This is distinct from the documented no-risk-window behavior: here the pool did observe an active-risk window, so the bonus is part of the CORRUPTED bounty if the correct outcome is good-faith CORRUPTED. A mistaken SURVIVED flag creates an interval where anyone can move that tracked bonus to the sponsor-controlled recovery address before the moderator corrects the outcome.

Severity: Low

The issue requires a pool with tracked bonus but no eligible stakers, so exploitability is narrow. The impact is concrete value misrouting: funds that should be included in the good-faith whitehat bounty are irreversibly swept to recoveryAddress.

Impact

The named good-faith attacker can lose the entire tracked bonus pool. Once swept, the corrected CORRUPTED snapshot records snapshotTotalBonus == 0, so claimAttackerBounty has no entitlement to the bonus even though it was contributed through the supported contributeBonus path before resolution.

Proof of Concept

1. A contributor adds 50e18 bonus tokens to a pool with no stakers.

2. The registry enters UNDER_ATTACK, and pokeRiskWindow() records riskWindowStart > 0.

3. The registry later becomes CORRUPTED, but the moderator first flags SURVIVED by mistake.

4. Anyone calls sweepUnclaimedBonus(), which transfers the full tracked bonus to recoveryAddress and leaves claimsStarted == false.

5. The moderator corrects to good-faith CORRUPTED.

6. The corrected snapshot has snapshotTotalBonus == 0 and bountyEntitlement == 0.

Validated with:

The PoC passed and showed the corrected good-faith bounty was zero after the SURVIVED-path sweep.

Mitigation

Do not allow sweepUnclaimedBonus to decrement or transfer tracked totalBonus while a moderator correction remains possible for a risk-observed pool. For example, either set claimsStarted on any sweep of tracked bonus, or block sweeping tracked bonus until finality is closed; post-resolution direct donations can still remain immediately recoverable.