BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Good-faith CORRUPTED bounty can be underpaid after bonus is swept during the re-flag window

Author Revealed upon completion

Root + Impact

Description

Intended behavior: before any claim starts, the moderator can re-flag an outcome to correct a mistaken SURVIVED / attacker / good-faith decision. For good-faith CORRUPTED, the named attacker should receive the full tracked pool: snapshotTotalStaked + snapshotTotalBonus.

Issue: sweepUnclaimedBonus() can move tracked bonus to recoveryAddress without setting claimsStarted. In the no-observed-risk case, this also decrements totalBonus. A later correction to good-faith CORRUPTED is still allowed, but the attacker’s bountyEntitlement is recomputed from the reduced totalBonus, so the attacker loses the swept bonus.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
​
snapshotTotalStaked = totalEligibleStake;
snapshotTotalBonus = totalBonus;
​
corruptedReserve = newOutcome == PoolStates.Outcome.CORRUPTED
? snapshotTotalStaked + snapshotTotalBonus
: 0;
​
@> bountyEntitlement = willBeGoodFaithCorrupted
? snapshotTotalStaked + snapshotTotalBonus
: 0;
}
​
function sweepUnclaimedBonus() external nonReentrant {
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
if (riskWindowStart != 0) {
reserved += snapshotTotalBonus - claimedBonus;
}
}
​
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
@> totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
@> // Does not set claimsStarted
@> stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • Reason 1: This occurs during the documented pre-claim correction window when the moderator first flags SURVIVED for a terminal CORRUPTED registry and later corrects to good-faith CORRUPTED.

  • Reason 2: The sweep is permissionless, and in the riskWindowStart == 0 path it can be executed immediately before any staker claim finalizes the outcome.

Impact:

  • Impact 1: The named good-faith attacker receives less than the intended full-pool bounty.

  • Impact 2: Up to the entire tracked bonus pool is redirected to recoveryAddress; in a bonus-only pool, the attacker can lose the whole intended bounty.

Proof of Concept

Below is the textual PoC:

// 1. Pool has 100 stake + 50 bonus. riskWindowStart == 0.
// 2. Registry is CORRUPTED.
// 3. Moderator flags SURVIVED.
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
// 4. Anyone sweeps unreserved bonus to recoveryAddress.
// totalBonus becomes 0, claimsStarted remains false.
pool.sweepUnclaimedBonus();
​
// 5. Moderator corrects to good-faith CORRUPTED.
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// 6. Attacker entitlement is now only 100, not 150.
pool.claimAttackerBounty();

Recommended Mitigation

Prevent tracked bonus from being swept while the re-flag window is still open. Pure donations can still be swept, but accounted totalBonus should remain until a real finality event occurs.

+ error BonusSweepBeforeFinality();
​
function sweepUnclaimedBonus() external nonReentrant {
...
if (totalEligibleStake == 0 || riskWindowStart == 0) {
+ uint256 accountedBonusSwept = amount <= totalBonus ? amount : totalBonus;
+ if (!claimsStarted && accountedBonusSwept != 0) {
+ revert BonusSweepBeforeFinality();
+ }
- totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ totalBonus -= accountedBonusSwept;
}
...
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!