BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Accounted bonus can be swept while the outcome-correction window remains open

Author Revealed upon completion

Description

  • The moderator may correct a previously flagged outcome until the first participant relies on it. claimsStarted is intended to close that correction window when value movement makes the old distribution final.

  • In a no-observed-risk SURVIVED outcome, sweepUnclaimedBonus lets any caller transfer the entire accounted totalBonus to recoveryAddress and decrements the live bonus accounting, but deliberately leaves claimsStarted false. The moderator can therefore still correct the outcome to good-faith CORRUPTED, yet the new bounty snapshot excludes bonus that has already left. The named whitehat permanently loses the advertised whole-pool bounty even though the contract still represents the outcome as correctable.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_)
external
onlyModerator
{
// @> Re-flagging remains available while claimsStarted is false.
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) {
revert OutcomeAlreadySet();
}
// ...
​
snapshotTotalStaked = totalEligibleStake;
// @> A correction re-snapshots the reduced live totalBonus.
snapshotTotalBonus = totalBonus;
bountyEntitlement =
willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;
}
​
function sweepUnclaimedBonus() external nonReentrant {
// ...
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
// @> With no observed risk, none of totalBonus is reserved.
if (riskWindowStart != 0) {
reserved += snapshotTotalBonus - claimedBonus;
}
}
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
// @> Accounted value is removed before the correction window closes.
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
// @> claimsStarted remains false even when amount includes accounted bonus.
stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood: Low

  • The path occurs when a terminal CORRUPTED registry has no locally observed risk window, the moderator initially flags SURVIVED, and a correction to good-faith CORRUPTED is later needed before any staker claim.

  • The initial flag must need correction, making the situation uncommon. During that advertised correction window, however, the sweep is permissionless and requires no special role, capital, or direct economic entitlement.

Impact: Medium

  • The entire accounted bonus can be irreversibly redirected to recoveryAddress before the corrected bounty is snapshotted.

  • The whitehat receives principal only instead of the documented full stake-plus-bonus bounty. Principal remains available, so the loss is limited to the bonus portion.

Proof of Concept

Add the following test to a contract inheriting BaseConfidencePoolTest, or run the existing test at test/poc/ReflagSweepBountyLoss.t.sol:

function testPermissionlessSweepMovesAccountedValueWithoutClosingCorrectionWindow()
external
{
_stake(alice, 100 * ONE);
_contributeBonus(carol, 50 * ONE);
​
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
uint256 recoveryBefore = token.balanceOf(recovery);
vm.prank(dave);
pool.sweepUnclaimedBonus();
​
assertEq(token.balanceOf(recovery) - recoveryBefore, 50 * ONE);
assertFalse(pool.claimsStarted());
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// The replacement snapshot sees only the remaining principal.
assertEq(pool.bountyEntitlement(), 100 * ONE);
​
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), 100 * ONE);
assertEq(token.balanceOf(recovery) - recoveryBefore, 50 * ONE);
}

Run:

forge test --match-contract ReflagSweepBountyLossPoC -vv

Recommended Mitigation

Separate unaccounted donations and dust from accounted totalBonus while correction remains possible. Donation-only value may remain permissionlessly sweepable without creating a 1-wei finality grief, but accounted bonus should stay reserved until either the first claim closes correction or the moderator explicitly finalizes the outcome.

+bool public outcomeFinalized;
+
+function finalizeOutcome() external onlyModerator {
+ if (outcome == PoolStates.Outcome.UNRESOLVED) revert OutcomeNotSet();
+ outcomeFinalized = true;
+}
​
function flagOutcome(...) external onlyModerator {
- if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) {
+ if (
+ outcome != PoolStates.Outcome.UNRESOLVED
+ && (claimsStarted || outcomeFinalized)
+ ) {
revert OutcomeAlreadySet();
}
// ...
}
​
function sweepUnclaimedBonus() external nonReentrant {
uint256 reserved = totalEligibleStake;
+ bool correctionOpen = !claimsStarted && !outcomeFinalized;
+
+ // Preserve accounted value needed by a possible replacement snapshot.
+ if (correctionOpen) {
+ reserved += totalBonus;
+ } else if (totalEligibleStake != 0 && riskWindowStart != 0) {
+ reserved += snapshotTotalBonus - claimedBonus;
+ }
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
// ...
}

An alternative is to escrow swept accounted bonus inside the protocol so a later correction can reclaim it. Simply setting claimsStarted during the current sweep is not sufficient: that would let a permissionless caller close the correction window and could make the loss larger by preventing the correction entirely.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!