[Medium] Pre-claim bonus sweep underpays corrected good-faith bounty

Description

flagOutcome() allows corrections before the first claim, but sweepUnclaimedBonus() can move accounted bonus to recoveryAddress in that window without setting claimsStarted.

When riskWindowStart == 0, the sweep treats tracked bonus as unreserved:

A later correction to good-faith CORRUPTED snapshots the reduced totalBonus.

This creates a gap between accounting finality and outcome finality. The pool still allows the moderator to correct the result, but part of the bonus base used for the future corruption payout can already be removed before that correction happens.

Risk

Anyone can divert contributed bonus to recoveryAddress, underpaying the good-faith attacker.

Example: Alice stakes 100 and a contributor adds 50 bonus. The registry is actually CORRUPTED, but riskWindowStart == 0. The moderator first flags SURVIVED. Anyone calls sweepUnclaimedBonus(), sending the 50 tracked bonus to recoveryAddress while claimsStarted remains false. The moderator then corrects to good-faith CORRUPTED, and the attacker receives only 100 instead of 150.

The important detail is that this is not sweepable dust or a direct token donation. The missing 50 tokens came from contributeBonus() and were part of totalBonus before the premature sweep reduced it.

Proof of Concept

Without the sweep, the corrected bounty is 150.

PoC flow:

1. Fund the pool with 100 stake and 50 tracked bonus.

2. Let the moderator flag a non-final incorrect outcome such as SURVIVED.

3. Call sweepUnclaimedBonus() before any claim starts.

4. Confirm that the sweep transfers the 50 bonus out and leaves claimsStarted == false.

5. Re-flag to good-faith CORRUPTED.

6. Observe that the attacker bounty snapshots only the remaining 100 stake and no longer includes the 50 contributed bonus.

Mitigation

Do not allow tracked bonus to be swept while the outcome can still be corrected. Set claimsStarted = true when sweeping totalBonus, or separate dust sweeping from tracked-bonus sweeping.

One concrete fix is to block tracked-bonus sweeps before outcome finality:

Another valid fix is to make sweeping accounted totalBonus itself finalize the pool for correction purposes before any transfer occurs.