BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Bonus sweep can redirect value during the moderator reflag window

Author Revealed upon completion

Root + Impact

Description

flagOutcome() allows the moderator to correct a previously flagged outcome until a claim starts. The design document describes claimsStarted as the value-movement finality latch: once value has left under an outcome, later correction can break accounting.

sweepUnclaimedBonus() is intended to recover bonus or excess tokens that are not owed to stakers. In the no-risk-window case, _bonusShare() returns zero, so accounted bonus can become sweepable to recoveryAddress.

Issue: sweepUnclaimedBonus() can transfer accounted totalBonus to recoveryAddress and decrement totalBonus without setting claimsStarted. This allows value to leave during the moderator reflag window while still allowing a later reflag that snapshots depleted bonus accounting.

When an outcome is first flagged as SURVIVED and later corrected to good-faith CORRUPTED, a prior sweepUnclaimedBonus() can reduce the named attacker's bounty from snapshotTotalStaked + original snapshotTotalBonus to only the remaining post-sweep balance.

function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
// Re-flag allowed pre-claim so the moderator can fix a typo'd outcome/attacker before
// any participant locks in the wrong distribution.
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
​
...
​
snapshotTotalStaked = totalEligibleStake;
snapshotTotalBonus = totalBonus;
corruptedReserve = newOutcome == PoolStates.Outcome.CORRUPTED ? snapshotTotalStaked + snapshotTotalBonus : 0;
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0;
}
​
function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
​
...
​
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
if (amount == 0) revert NothingToSweep();
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
// @> Accounted bonus can be decremented and swept while the outcome is still reflaggable.
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
// @> Value leaves the contract, but claimsStarted is intentionally not set.
stakeToken.safeTransfer(recoveryAddress, amount);
}

Risk

Likelihood:

  • A moderator flags SURVIVED while the registry is terminal CORRUPTED, then later corrects the outcome to good-faith CORRUPTED.

  • A no-risk-window pool has riskWindowStart == 0, causing _bonusShare() to return zero and making accounted bonus sweepable before the moderator correction occurs.

  • Any caller can execute sweepUnclaimedBonus() between the first flag and the moderator's corrective reflag.

Impact:

  • The named good-faith attacker receives a smaller bounty than the pool accounting promised for CORRUPTED resolution.

  • Accounted bonus is redirected to recoveryAddress before the final corrected outcome is established.

  • The reflag window no longer preserves value-distribution correctness, despite claimsStarted being treated as the finality latch.

Proof of Concept

// Initial state:
// - totalEligibleStake = 100
// - totalBonus = 50
// - stakeToken.balanceOf(pool) = 150
// - riskWindowStart = 0
// - registry state = CORRUPTED
// - outcome = UNRESOLVED
​
// 1. Moderator initially flags SURVIVED.
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
// 2. Because riskWindowStart == 0, no staker is owed bonus.
// sweepUnclaimedBonus() treats the 50 bonus as free balance.
pool.sweepUnclaimedBonus();
​
// State after sweep:
// - recoveryAddress received 50
// - stakeToken.balanceOf(pool) = 100
// - totalBonus = 0
// - claimsStarted = false
​
// 3. Moderator corrects to good-faith CORRUPTED.
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
// 4. Bounty is snapshotted from depleted accounting.
// bountyEntitlement = snapshotTotalStaked + snapshotTotalBonus
// = 100 + 0
// = 100
​
// Expected without the intermediate sweep:
// bountyEntitlement = 100 + 50 = 150
​
// Result:
// - attacker receives only 100 instead of 150
// - 50 was redirected to recoveryAddress during the reflag window
​

Recommended Mitigation

function sweepUnclaimedBonus() external nonReentrant {
+ if (outcome != PoolStates.Outcome.UNRESOLVED && !claimsStarted) {
+ revert OutcomeStillReflaggable();
+ }
+
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
​

An alternative mitigation is to keep sweepUnclaimedBonus() callable before claimsStarted, but reserve accounted totalBonus while the outcome remains reflaggable and allow only unaccounted donations or dust to be swept.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!