BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

Permissionless bonus sweep can reduce a subsequently corrected good-faith CORRUPTED bounty

Author Revealed upon completion

Root + Impact

Description

  • Before a participant claim starts, the moderator may correct a SURVIVED outcome to good-faith CORRUPTED. A good-faith CORRUPTED resolution entitles the named attacker to the stake and bonus captured by that resolution snapshot.

  • Following a SURVIVED flag with no observed risk window, any account may call sweepUnclaimedBonus(). The function transfers the full accounted bonus to recoveryAddress and reduces totalBonus, but deliberately leaves claimsStarted == false. A subsequent correction to good-faith CORRUPTED remains callable yet snapshots the reduced totalBonus, so the attacker receives principal only while the recovery beneficiary retains the bonus.

  • Contest caveat: testReflagToCorruptedAfterBonusSweepDoesNotOverstateEntitlement() explicitly asserts that the corrected entitlement excludes funds already swept. This makes the behavior demonstrably intentional and creates substantial rejection risk.

function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
​
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
if (riskWindowStart != 0) {
reserved += snapshotTotalBonus - claimedBonus;
}
}
​
uint256 freeBalance = stakeToken.balanceOf(address(this));
uint256 amount = freeBalance > reserved ? freeBalance - reserved : 0;
if (amount == 0) revert NothingToSweep();
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
// @> Reduces the live bonus used by a later correction snapshot.
totalBonus -= amount <= totalBonus ? amount : totalBonus;
}
​
// @> Real value leaves, but the moderator correction window remains open.
// @> A corrected good-faith bounty can no longer include this bonus.
stakeToken.safeTransfer(recoveryAddress, amount);
}
​
function flagOutcome(PoolStates.Outcome newOutcome, bool goodFaith_, address attacker_) external onlyModerator {
if (outcome != PoolStates.Outcome.UNRESOLVED && claimsStarted) revert OutcomeAlreadySet();
// ...validation...
​
snapshotTotalStaked = totalEligibleStake;
// @> Reads the bonus after sweepUnclaimedBonus reduced it.
snapshotTotalBonus = totalBonus;
bountyEntitlement = newOutcome == PoolStates.Outcome.CORRUPTED && goodFaith_
? snapshotTotalStaked + snapshotTotalBonus
: 0;
}

Risk

Likelihood:

  • Occurs after the moderator initially flags SURVIVED on a terminal CORRUPTED registry without a locally observed active-risk window.

  • The value transfer becomes final when a permissionless caller executes sweepUnclaimedBonus() before the moderator submits a good-faith CORRUPTED correction.

Impact:

  • The named good-faith attacker loses the full bonus component of the corrected bounty.

  • Bonus funds are redirected to the sponsor-controlled recoveryAddress before the corrected outcome can reserve them.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {BaseConfidencePoolTest} from "test/helpers/BaseConfidencePoolTest.sol";
import {PoolStates} from "src/libraries/PoolStates.sol";
import {IAttackRegistry} from "@battlechain/interface/IAttackRegistry.sol";
​
contract PreReflagBonusSweepPoC is BaseConfidencePoolTest {
function test_BonusSweepReducesCorrectedGoodFaithBounty() external {
_stake(alice, 100 * ONE);
_contributeBonus(carol, 50 * ONE);
​
// Terminal CORRUPTED is observed without an active-risk observation.
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
assertEq(pool.riskWindowStart(), 0);
assertFalse(pool.claimsStarted());
​
// Any account can move the accounted bonus to recovery.
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery), 50 * ONE);
assertEq(pool.totalBonus(), 0);
assertFalse(pool.claimsStarted());
​
// The moderator correction still succeeds, but snapshots only principal.
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
​
assertEq(pool.snapshotTotalBonus(), 0);
assertEq(pool.bountyEntitlement(), 100 * ONE);
​
vm.prank(attacker);
pool.claimAttackerBounty();
​
assertEq(token.balanceOf(attacker), 100 * ONE);
assertEq(token.balanceOf(recovery), 50 * ONE);
}
}

Recommended Mitigation

Treat sweeping accounted bonus as distribution finality. A sweep consisting only of unsolicited donations or arithmetic dust may remain non-finalizing, but movement of totalBonus should close the correction window.

function sweepUnclaimedBonus() external nonReentrant {
// ...calculate amount...
​
if (totalEligibleStake == 0 || riskWindowStart == 0) {
- totalBonus -= amount <= totalBonus ? amount : totalBonus;
+ uint256 accountedBonusSwept = amount <= totalBonus ? amount : totalBonus;
+ totalBonus -= accountedBonusSwept;
+ if (accountedBonusSwept != 0 && !claimsStarted) {
+ claimsStarted = true;
+ }
}
​
stakeToken.safeTransfer(recoveryAddress, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!