BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

sweepUnclaimedBonus moves the bonus without latching claimsStarted, so a later SURVIVED->CORRUPTED re-flag computes the bounty on an emptied snapshot and underpays the whitehat by the whole bonus

Author Revealed upon completion

Root + Impact

src/ConfidencePool.sol — sweepUnclaimedBonus moves real value (the bonus) out of the pool but intentionally does NOT latch claimsStarted (to avoid a 1-wei donation blocking the §4 re-flag window). The moderator's re-flag window therefore stays open AFTER the bonus has physically left the pool. A re-flag that changes the outcome then computes its distribution against snapshotTotalBonus, which the sweep has already zeroed — producing a payout short by the entire bonus.

When riskWindowStart == 0 (no observed risk — e.g. a direct-to-CORRUPTED or direct-to-PRODUCTION agreement), the bonus is unreserved and fully sweepable under a SURVIVED/EXPIRED flag. Sequence: moderator flags SURVIVED -> anyone sweeps the bonus to recoveryAddress -> moderator re-flags good-faith CORRUPTED (a legitimate §4 correction) -> the named whitehat's bountyEntitlement is computed as snapshotTotalStaked + snapshotTotalBonus, but snapshotTotalBonus is now 0. The whitehat receives only principal; the entire bonus is stuck at recoveryAddress.

Impact: the whitehat — who under good-faith CORRUPTED is entitled to the WHOLE pool — is underpaid by the full bonus, which is misdirected to the sponsor's recoveryAddress. Direct loss of funds for the legitimate CORRUPTED beneficiary; the §4 correction mechanism is not safe against an interleaved sweep.

Description

sweepUnclaimedBonus does not latch finality:

// Intentionally does NOT set claimsStarted. A direct-transfer donation of as little as 1
// wei would otherwise let anyone flip the flag post-flagOutcome and block the moderator's
// documented pre-claim re-flag window. Genuine reliance only comes from claim entrypoints.
stakeToken.safeTransfer(recoveryAddress, amount);

@> amount is the FULL bonus when riskWindowStart == 0, not a 1-wei donation. It leaves the pool irreversibly, yet the re-flag window stays open. The same function also does totalBonus -= amount in this case, so the live totalBonus is now 0.

re-flag recomputes the snapshot from the emptied totalBonus:

snapshotTotalBonus = totalBonus; // already 0 after the sweep
...
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;

@> bountyEntitlement is missing the bonus, so claimAttackerBounty pays the whitehat principal only.

Sequence:

  1. riskWindowStart == 0 (agreement reaches a terminal state without an observed risk window).

  2. Moderator flags SURVIVED (breach judged out-of-scope — §8 allows SURVIVED on a CORRUPTED registry).

  3. sweepUnclaimedBonus() (permissionless) sends the full bonus to recoveryAddress; does not latch claimsStarted.

  4. Moderator re-flags good-faith CORRUPTED (new info: the breach was in-scope). Allowed because claimsStarted == false (§4 window open).

  5. bountyEntitlement = snapshotTotalStaked + 0. Whitehat claims and receives principal only; bonus stuck at recoveryAddress.

Risk

Likelihood: Low — requires riskWindowStart == 0, a SURVIVED->CORRUPTED moderator correction, and a sweep interleaved between the two flags. The sweep is permissionless and a sponsor who controls recoveryAddress is incentivized to call it.

Impact: High — direct loss of funds: the whitehat is underpaid by the entire bonus, which is misdirected to the sponsor.

Proof of Concept

forge test --match-contract SweepThenReflagUnderpaysAttackerTest -vv passes against the in-scope contracts:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {IConfidencePool} from "src/interfaces/IConfidencePool.sol";
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
​
contract SweepThenReflagUnderpaysAttackerTest is BaseConfidencePoolTest {
function test_sweepBonusThenReflagCorrupted_underpaysWhitehat() external {
_stake(alice, 100 * ONE);
_contributeBonus(makeAddr("sponsor"), 500 * ONE);
​
// Agreement goes terminal CORRUPTED directly (no UNDER_ATTACK => riskWindowStart 0).
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
pool.pokeRiskWindow();
assertEq(pool.riskWindowStart(), 0, "no risk window observed");
​
// Moderator flags SURVIVED (breach judged out-of-scope).
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
// Anyone sweeps the unreserved bonus to recoveryAddress. Does NOT latch claimsStarted.
pool.sweepUnclaimedBonus();
assertEq(pool.claimsStarted(), false, "re-flag window still open");
​
// Moderator corrects to good-faith CORRUPTED, naming the whitehat.
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// Entitlement should be 600 (stake + bonus); it is only 100.
assertEq(pool.bountyEntitlement(), 100 * ONE, "entitlement missing the 500 bonus");
​
uint256 before = token.balanceOf(attacker);
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker) - before, 100 * ONE, "whitehat underpaid: bonus lost to recovery");
}
}

Recommended Mitigation

Any of: (a) latch claimsStarted = true in sweepUnclaimedBonus when it moves non-dust value — distinguish a real bonus sweep from a 1-wei donation-dust sweep and only skip the latch for dust — closing the re-flag window once real value has left; (b) block sweepUnclaimedBonus while the outcome is still re-flaggable (claimsStarted == false), reserving the bonus until the outcome is final; (c) on re-flag, derive the new snapshotTotalBonus from accounting that includes already-swept amounts, so a prior sweep cannot silently shrink the new outcome's entitlement.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!