BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Anyone Can Sweep The Bonus Before The Moderator Corrects A Wrong Outcome, So The Whitehat Loses The Bonus Money

Author Revealed upon completion

Anyone Can Sweep The Bonus Before The Moderator Corrects A Wrong Outcome, So The Whitehat Loses The Bonus Money

Description

  • Anyone can call sweepUnclaimedBonus() to send leftover bonus money to recoveryAddress. Separately, the moderator can fix a wrong outcome (a "re-flag") as long as no money has been claimed yet.

  • The problem is that sweepUnclaimedBonus() sends the bonus money out of the pool and can be called by anyone. So if the moderator later corrects a wrong outcome to CORRUPTED and names a whitehat who is owed the whole pool (stake + bonus), the bonus may already be gone. The whitehat ends up with only the stake, and recoveryAddress keeps bonus money it should not get.

https://github.com/CodeHawks-Contests/2026-07-bc-confidence-pools/blob/58e8ba4ce3f3277866e4926f3140e597f9554a1e/src/ConfidencePool.sol#L474-L509

@> function sweepUnclaimedBonus() external nonReentrant {
...
​
stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • This happens whenever the moderator first flags SURVIVED by mistake, then later corrects it to CORRUPTED and names a whitehat.

  • Sweeping the bonus costs nothing and never hurts the caller, so anyone has a reason to do it.

Impact:

  • The whitehat named in the correction gets only the stake, not the bonus they were supposed to get.

  • recoveryAddress permanently keeps bonus money it should not get.

Proof of Concept

The codebase already has a test for this same sequence (testReflagToCorruptedAfterBonusSweepDoesNotOverstateEntitlement), but it only checks that nothing breaks — not that the whitehat gets shortchanged, which is what this test shows. Add this in SweepUnclaimedBonus.t.sol.

function testBonusPermanentlyDivertedToRecoveryWhenSweepRacesGoodFaithReflag() external {
uint256 stakeAmt = 100 * ONE;
uint256 bonusAmt = 50 * ONE;
​
_stake(alice, stakeAmt);
_contributeBonus(carol, bonusAmt);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
assertEq(pool.riskWindowStart(), 0);
​
// Bonus is swept away while the outcome still says SURVIVED.
address searcher = makeAddr("searcher");
vm.prank(searcher);
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery), bonusAmt);
​
// Moderator corrects the outcome. This still works.
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// Whitehat only gets the stake, not stake + bonus.
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), stakeAmt);
assertEq(token.balanceOf(recovery), bonusAmt);
}

Recommended Mitigation

Only let the moderator call sweepUnclaimedBonus(). This closes off the third party racing to send out the bonus before a correction.

- function sweepUnclaimedBonus() external nonReentrant {
+ function sweepUnclaimedBonus() external nonReentrant onlyModerator {
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!