BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

`AttackerBountyClaimed` is emitted on a zero payout, decoupling the event from the state transition

Author Revealed upon completion

Root + Impact

Description

  • The AttackerBountyClaimed event should track actual bounty transfers so off-chain indexers can rely on it.

  • The emit sits outside the if (payout > 0) block, so a bounty call that transfers nothing still emits AttackerBountyClaimed(attacker, 0, ...), and claimsStarted is not set on that branch — the event and the state transition are inconsistent.

// src/ConfidencePool.sol — claimAttackerBounty()
if (payout > 0) {
corruptedReserve -= payout;
if (!claimsStarted) claimsStarted = true;
stakeToken.safeTransfer(attacker, payout);
}
@> emit AttackerBountyClaimed(attacker, payout, newBountyClaimed, bountyEntitlement); // fires even when payout == 0

Risk

Likelihood:

  • Occurs on a bounty call that resolves to payout == 0 (practically reachable only via a defective stake token, since the pool balance equals the entitlement at flag time).

Impact:

  • Off-chain indexers may record a spurious zero-value bounty-claim event; the event is emitted without the corresponding state change. Cosmetic; no funds affected.

Proof of Concept

test/fuzz/ConfidencePool.qa.t.sol asserts the event args on a real full claim; the residual is that the
same emit also runs on the payout == 0 path:

vm.expectEmit(true, false, false, true, address(pool));
emit IConfidencePool.AttackerBountyClaimed(attacker, entitlement, entitlement, entitlement);
vm.prank(attacker);
pool.claimAttackerBounty();

Recommended Mitigation

if (payout > 0) {
corruptedReserve -= payout;
if (!claimsStarted) claimsStarted = true;
stakeToken.safeTransfer(attacker, payout);
+ emit AttackerBountyClaimed(attacker, payout, newBountyClaimed, bountyEntitlement);
}
- emit AttackerBountyClaimed(attacker, payout, newBountyClaimed, bountyEntitlement);
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!