Root + Impact

Description

At or after expiry, any address can call claimExpired() to mechanically resolve an unresolved pool. When the registry reports CORRUPTED, the function selects auto-CORRUPTED only if riskWindowStart != 0. If no successful call observed an earlier active-risk state, the same registry result instead falls through to EXPIRED.

Mechanical resolution sets claimsStarted = true even when the caller has no stake and receives no payout. A non-staker can therefore win the first post-expiry transaction, lock the principal-returning EXPIRED outcome, and permanently prevent the moderator from flagging the pool CORRUPTED. This changes the allocation of the staked principal from sponsor recovery to the stakers.

The auto-CORRUPTED branch combines the terminal registry state with a local observation latch:

riskWindowStart is set only when UNDER_ATTACK or PROMOTION_REQUESTED is successfully observed. It can remain zero if the registry moves directly to CORRUPTED, if no one calls an observing function during the active-risk interval, or if the only attempted observations occur in transactions whose later checks revert and roll the marker back.

Once claimExpired() sets EXPIRED and latches claimsStarted, the moderator finality check prevents a corrective flag:

The allocation difference is material. A bad-faith CORRUPTED outcome sends the full pool balance—principal and bonus—to recoveryAddress. EXPIRED returns principal to stakers; with no observed risk, stakers receive no bonus and only the bonus is sweepable to recovery. The permissionless caller need not profit directly to grief the sponsor or favor the stakers.

The behavior is acknowledged by the design as a resolution race, and the zero-start condition requires a missed risk observation. Those facts lower likelihood, but they do not prevent deterministic preemption once the edge state exists.

Risk

Likelihood:

• The registry must report CORRUPTED at expiry while riskWindowStart remains zero, which requires a direct transition or a failure to persist an active-risk observation.

• Any account can execute the preemption at the first post-expiry opportunity; no stake, token approval, or special role is required.

• The moderator can avoid the outcome by flagging CORRUPTED before expiry resolution, but transaction ordering at the boundary is public and contestable.

Impact:

• The final outcome changes from sponsor-recoverable CORRUPTED to principal-returning EXPIRED and cannot be corrected afterward.

• All staked principal can be diverted away from the recovery recipient, while only unearned bonus remains sweepable.

• Moderator good-faith classification and attacker-bounty selection are also permanently foreclosed by the finality latch.

Proof of Concept

Create test/audit/CP038ClaimExpiredPreemptsModerator.t.sol with the following contents:

Run the PoC from the repository root:

1. Execute forge test --offline --match-path test/audit/CP038ClaimExpiredPreemptsModerator.t.sol -vv.

2. Confirm that the test passes. A non-staker resolves the zero-start CORRUPTED registry state as EXPIRED, the moderator's corrective CORRUPTED call reverts, the staker receives 100 principal, and recovery receives only the 50 bonus.

Recommended Mitigation

Apply the moderator grace period whenever the registry reports CORRUPTED, even if the local start marker is zero. During that interval the moderator can decide whether the breach was within this pool's scope and whether the missing observation should affect classification. After the grace period, preserve the existing liveness policy: auto-CORRUPTED when risk was observed, otherwise EXPIRED.

Add explicit tests for direct CORRUPTED transitions, reverted active-risk observations, non-staker resolvers, and same-block moderator/resolver ordering. A stronger design would derive the risk interval from canonical registry transition data rather than a lazily persisted local marker, removing the observation-dependent ambiguity entirely.