docs: submit vulnerability report for dispute_sink_balance lock (Issue #5)

Author: minimalmod

VULNERABILITY_REPORT.md

@@ -0,0 +1,68 @@
+# Vulnerability Report: Permanent Lock of Dispute Sink USDC (No Withdrawal Mechanism)
+
+## Summary
+
+In `market_app/contract.py`, the `dispute_sink_balance` state variable accumulates USDC from slashed dispute bonds but **has no withdrawal method**. Combined with the absence of a `DeleteApplication` handler, this permanently locks funds in the contract with no recovery path.
+
+## Vulnerability Detail
+
+When a dispute is resolved, a portion of the losing party's bond is routed to `dispute_sink_balance`:
+
+```python
+# contract.py line 726 (_settle_confirmed_dispute — loser is challenger)
+self.dispute_sink_balance.value = self.dispute_sink_balance.value + (losing_bond - winner_bonus)
+
+# contract.py line 736 (_settle_overturned_dispute — loser is proposer)
+self.dispute_sink_balance.value = self.dispute_sink_balance.value + (losing_bond - winner_bonus)
+
+# contract.py line 745 (_settle_cancelled_dispute — proposer bond fully slashed)
+self.dispute_sink_balance.value = self.dispute_sink_balance.value + self.proposer_bond_held.value
+```
+
+The variable is initialized to 0 in `create()` (line 864) and only ever incremented. A comprehensive search of the entire codebase confirms:
+
+1. **No `withdraw_dispute_sink()` method exists** — there is no ABI method that decrements `dispute_sink_balance` or sends the corresponding USDC to any address (treasury, admin, or otherwise).
+2. **No `DeleteApplication` handler exists** — the contract has no `@arc4.baremethod(allow_actions=["DeleteApplication"])`, so the AVM rejects any delete call. Even if deletion were possible, ASA (USDC) balances require explicit inner transactions to transfer before deletion — passive ALGO close-out does not apply to ASAs.
+3. **No admin override exists** — neither `market_admin`, `resolution_authority`, nor `creator` have any path to extract these funds.
+
+### Comparison with other balance types
+
+Every other tracked USDC balance has an explicit withdrawal path:
+
+| Balance Variable | Withdrawal Method | Access Control |
+|---|---|---|
+| `pool_balance` | `claim()`, `refund()`, `claim_lp_residual()` | Users, LPs |
+| `lp_fee_balance` | `withdraw_lp_fees()` | LPs |
+| `protocol_fee_balance` | `withdraw_protocol_fees()` | Anyone (→treasury) |
+| `resolution_budget_balance` | `reclaim_resolution_budget()` | Creator |
+| `proposer_bond_held` | `_credit_pending_payout()` → `withdraw_pending_payouts()` | Winner |
+| `challenger_bond_held` | `_credit_pending_payout()` → `withdraw_pending_payouts()` | Winner |
+| **`dispute_sink_balance`** | **❌ NONE** | **N/A** |
+
+## Impact
+
+**MEDIUM — Permanent fund lock.** USDC accumulates in the contract with no recovery.
+
+With `DEFAULT_DISPUTE_SINK_SHARE_BPS = 5000` (50%), half of every losing bond is permanently locked. For a market with a 1,000 USDC challenge bond and an overturned dispute in which the proposer had posted a 1,000 USDC bond:
+
+- `winner_bonus = floor(1000 * 5000 / 10000) = 500 USDC` → winner
+- `dispute_sink = 1000 - 500 = 500 USDC` → **permanently locked**
+
+Across many resolved markets, the cumulative locked amount grows without bound.
+
+## Recommendation
+
+Add a `withdraw_dispute_sink` method gated to an authorized role (e.g., `protocol_treasury` or `market_admin`):
+
+```python
+@arc4.abimethod()
+def withdraw_dispute_sink(self) -> None:
+    self._require_status_any2(UInt64(STATUS_RESOLVED), UInt64(STATUS_CANCELLED))
+    amount = self.dispute_sink_balance.value
+    self._require(amount > UInt64(0))
+    self.dispute_sink_balance.value = UInt64(0)
+    self._send_currency(Account(self.protocol_treasury.value), amount)
+    arc4.emit("WithdrawDisputeSink(uint64)", arc4.UInt64(amount))
+```
+
+Alternatively, fold the sink share into `protocol_fee_balance` during settlement so it is withdrawn via the existing `withdraw_protocol_fees()` path.