BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Bonus sweep shorts corrected whitehat bounty

Author Revealed upon completion

Affected: ConfidencePool.sol:474-509 · ConfidencePool.sol:355-362

Description

When riskWindowStart == 0, sweepUnclaimedBonus() transfers the accounted bonus to recoveryAddress and reduces totalBonus, but intentionally leaves claimsStarted = false. A subsequent legitimate correction from SURVIVED to good-faith CORRUPTED re-snapshots the now-depleted totalBonus, so bountyEntitlement collapses to principal-only.

// L499-506
if (totalEligibleStake == 0 || riskWindowStart == 0) {
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
// Intentionally does NOT set claimsStarted. [anti-donation-grief]
stakeToken.safeTransfer(recoveryAddress, amount);
​
// L358, L362 — correction re-reads live totals
snapshotTotalBonus = totalBonus;
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;

Sequence: moderator flags SURVIVED (out-of-scope) → permissionless sweepUnclaimedBonus() → moderator corrects to good-faith CORRUPTED → whitehat claims principal only; the swept bonus is unrecoverable. Breaks DESIGN.md §4 (value movement locks correction) and §12 (good-faith bounty = entire pool).

Risk

Likelihood: Documented, honest sequence — DESIGN §8 supports out-of-scope SURVIVED on CORRUPTED registry; DESIGN §4 keeps correction open until first value movement.

Impact: Permanent misallocation of totalBonus to recoveryAddress; whitehat is short the full bonus and pool balance is zero.

Actor: sweepUnclaimedBonus() is permissionless.

Recommended Mitigation

Set claimsStarted only when the sweep removes accounted bonus. Dust/donation-only sweeps still leave the window open.

if (totalEligibleStake == 0 || riskWindowStart == 0) {
- totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ uint256 accountedBonusSwept = amount <= totalBonus ? amount : totalBonus;
+ totalBonus -= accountedBonusSwept;
+ if (accountedBonusSwept != 0 && !claimsStarted) claimsStarted = true;
}

Proof of Concept

Save as test/M1BonusSweepReflagPoC.t.sol and run forge test --match-contract M1BonusSweepReflagPoC -vv.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
​
contract M1BonusSweepReflagPoC is BaseConfidencePoolTest {
uint256 internal constant PRINCIPAL = 100 * ONE;
uint256 internal constant BONUS = 50 * ONE;
​
function testBonusSweepShortsCorrectedWhitehatBounty() external {
_stake(alice, PRINCIPAL);
_contributeBonus(carol, BONUS);
​
// Canonical lifecycle; no pool call during UNDER_ATTACK -> riskWindowStart stays 0.
attackRegistry.setAgreementState(IAttackRegistry.ContractState.ATTACK_REQUESTED);
vm.warp(block.timestamp + 1 days);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.UNDER_ATTACK);
vm.warp(block.timestamp + 7 days);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
vm.prank(bob);
pool.sweepUnclaimedBonus();
assertFalse(pool.claimsStarted());
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.bountyEntitlement(), PRINCIPAL);
​
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), PRINCIPAL); // whitehat: principal only
assertEq(token.balanceOf(recovery), BONUS); // recovery: full bonus already gone
assertEq(token.balanceOf(address(pool)), 0); // shortfall unrecoverable
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!