BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Pre-claim `sweepUnclaimedBonus` permanently shrinks a corrected good-faith bounty

Author Revealed upon completion

Summary

sweepUnclaimedBonus moves the full bonus to recoveryAddress without latching claimsStarted. If the moderator later corrects a SURVIVED flag to good-faith CORRUPTED, the re-snapshot uses the reduced totalBonus, so the whitehat's bounty permanently excludes the swept bonus — breaking the DESIGN §4 promise that the pre-claim correction window is lossless.

Description

Under a moderator SURVIVED flag with riskWindowStart == 0, the bonus is unreserved and swept to recoveryAddress, zeroing totalBonus, but claimsStarted is intentionally left false (src/ConfidencePool.sol:499-506):

if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus; // -> 0
}
stakeToken.safeTransfer(recoveryAddress, amount); // claimsStarted stays false

Because the window stays open, a correction to good-faith CORRUPTED re-snapshots the reduced bonus:

snapshotTotalBonus = totalBonus; // L358 — reduced
bountyEntitlement = snapshotTotalStaked + snapshotTotalBonus; // L362 — missing swept bonus

This window opens only via a moderator flagOutcome(SURVIVED) — the claimExpired auto-resolve paths latch claimsStarted (L549, L575) and are immune.

Risk

Likelihood: Low — requires a moderator SURVIVED → CORRUPTED correction with a permissionless sweep interleaved.

Impact: Medium — the bonus portion of a good-faith bounty is permanently diverted from the whitehat to the sponsor-controlled recoveryAddress.

Proof of Concept

test/poc/ManualReviewPoC.t.sol::testPoC_preClaimBonusSweepShrinksCorrectedBounty:

function testPoC_preClaimBonusSweepShrinksCorrectedBounty() external {
_stake(alice, 1000 * ONE);
_contributeBonus(carol, 300 * ONE);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED); // riskWindowStart == 0
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0)); // does NOT latch claimsStarted
​
pool.sweepUnclaimedBonus(); // full 300 bonus -> recovery, totalBonus -> 0
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, whitehat); // re-snapshots reduced totalBonus
​
assertEq(pool.bountyEntitlement(), 1000 * ONE); // principal only, NOT 1300
assertLt(pool.bountyEntitlement(), 1300 * ONE);
}

Result (-vvvv):

[PASS] testPoC_preClaimBonusSweepShrinksCorrectedBounty()
├─ flagOutcome(1, false, 0x0) // SURVIVED, claimsStarted false
├─ sweepUnclaimedBonus()
│ ├─ emit Transfer(from: pool, to: recovery, value: 3e20) // bonus leaves the pool
│ └─ emit BonusSwept(..., amount: 3e20)
├─ flagOutcome(2, true, whitehat) // corrected CORRUPTED
└─ bountyEntitlement() → 1e21 // 1000, not 1300

Recommended Mitigation

Latch claimsStarted when the sweep decrements accounted totalBonus (value-movement finality). A pure donation/dust sweep still does not latch, so a 1-wei donation cannot foreclose the re-flag window.

if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ // Accounted bonus has left the pool: this IS value-movement finality. Latch it so a
+ // later re-flag cannot re-snapshot a reduced totalBonus and shrink the bounty.
+ if (!claimsStarted) claimsStarted = true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!