Security : FeeDistributor centralization risks + grief surface

[philpof102-svg]

Three combined FeeDistributor findings :

1. Owner can rug keeperShareBps to 0 in one tx (MAX_BPS_CHANGE=500, current=100, diff to 0 is 100). No timelock. Keepers built expecting 1% suddenly get 0.
2. distribute() bricks if either sink reverts — combined with PR Security HIGH: NodeStaking.depositRevenue O(n) loops gas DoS #7's O(n) DoS, weekly distributions lock up entirely.
3. setSinks no timelock — owner can redirect 99% of protocol revenue with single tx.

Full PoC + 7-day timelock fix pattern in BUG_REPORT_feedist_centralization_and_griefing.md.

6th PR in continuous Gitlawb audit (#5 #6 #7 #8 #9 #10). Reporter @philpof102-svg.

[philpof102-svg]

Upgraded with merge-ready fix (src/GitlawbFeeDistributor.sol, +56/-4).

Two of the three issues fixed in this PR ; the third (sink revert grief) is deferred to a follow-up to keep this diff reviewable.

1) Keeper-share floor

uint256 public constant MIN_KEEPER_SHARE_BPS = 25; // 0.25 %

function setSplit(uint256 _n, uint256 _u, uint256 _k) external {
    ...
    if (_k < MIN_KEEPER_SHARE_BPS) revert KeeperShareTooLow();
    ...
}

Stops the multi-update walk-to-zero where owner shifts keeperShareBps by MAX_BPS_CHANGE per call until permissionless cron stops being profitable.

2) Sink timelock (replace setSinks with queue / execute / cancel)

uint256 public constant SINK_TIMELOCK = 2 days;
address public pendingNodeStaking;
address public pendingUserStaking;
uint256 public pendingSinksEta;

function queueSinks(address _n, address _u) external { ... } // emits SinksQueued
function executeSinks() external { ... } // only after eta
function cancelSinks() external { ... }

Stakers get a 2-day window to exit if the queued sink is malicious. Monitor SinksQueued events. cancelSinks lets the owner abort a queued change safely.

Migration : scripts/UI that called setSinks(a, b) must split into queueSinks(a, b) → wait → executeSinks().

The sink-revert grief (where a malicious sink reverts on depositRevenue and bricks the whole distribute() call) is a separate diff — needs try/catch wrapping in distribute and a partial-failure event. Happy to do that as a follow-up PR if you want to merge this one first.