Security MEDIUM-HIGH : Bounty retroactive fee bump rugpulls escrowed bounties

[philpof102-svg]

approveBounty reads CURRENT protocolFeeBps instead of fee-at-creation. Owner front-runs an inflight approval with setProtocolFee(1000) → claimant share drops 5% → owner pockets the delta on a bounty they had no role in creating.

Same class as variable-rate-without-notice. Fix : snapshot feeBpsAtCreation in createBounty, use it in approveBounty.

Full PoC + fix code in BUG_REPORT_bounty_retroactive_fee.md.

7th PR in continuous Gitlawb audit. Related : #5, #6, #7, #8, #9, #10. Reporter @philpof102-svg.

[philpof102-svg]

Upgraded with merge-ready fix (src/GitlawbBounty.sol, +7/-2).

Minimal diff : snapshot protocolFeeBps at createBounty() and use it at approveBounty() instead of the live value.

struct Bounty { ...; uint256 feeBpsSnapshot; }

function createBounty(...) external returns (uint256) {
    ...
    bounties[bountyId] = Bounty({
        ...
        feeBpsSnapshot: protocolFeeBps // locked at escrow time
    });
}

function approveBounty(uint256 bountyId) external ... {
    Bounty storage b = bounties[bountyId];
    uint256 fee = (b.amount * b.feeBpsSnapshot) / 10000; // was: protocolFeeBps
    ...
}

Matches how every mature escrow / lending protocol handles rate changes (Aave, Compound, Morpho, Uniswap fee tiers — all snapshot at obligation time). Bounty creators get a guarantee that the agent's payout = amount * (10000 - feeAtCreation) / 10000.

Backward compatible : pre-fix bounties have feeBpsSnapshot == 0, which means they pay 0% fee on approval. Conservative default — does NOT retroactively tax in-flight bounties (the whole point of this PR).