docs: add tokenomics vulnerabilities 39 and 40

[DavidMinarsch]

Two new entries, from internal review.

39 — A retired L2 target dispenser cannot forward or release a late arrival

DefaultTargetDispenserL2.migrate() sweeps the balance to the new dispenser and then closes the old one permanently:

// Zero the owner
owner = address(0);
...
// _locked is now set to 2 for good

Both statements are terminal, and the closing comment records the intent. With owner zeroed every owner-gated path is unreachable; with _locked left at 2 every guarded path is too.

A staking claim's token leg and message leg settle independently. A token leg dispatched before migration can land afterwards on an address with no code path able to move it — no forwarding function, no rescue. The amount is unrecoverable, not merely stuck.

migrate() does require a pause first, which is the intended settle-then-migrate procedure — but a pause stops new dispatches, not a transfer already in flight across the bridge. Nobody can cause this deliberately; the trigger is the migration's own timing, so it is recorded as an operational property rather than an attack.

Mitigation: keep a forwarding path on the retired dispenser — leave owner set to the new dispenser, or add a rescue(address token) callable by it.

40 — L1 claim state advances before an Arbitrum retryable is known redeemable

if (params.gasPriceBid < 2 || params.maxSubmissionCostMessage == 0) {
    revert ZeroValue();
}

A bid of 2 passes. A reserve-covered claim then advances L1 bookkeeping — including consuming the withheld amount — and enqueues the retryable at that boundary value. If the bid is not executable, the message can expire while the L1 side already treats the claim as settled.

The bid is the claimant's own input, and a low one mainly harms their own message. What is not theirs to control is the ordering: state advances before delivery is known to be executable, which is a property of the state machine rather than of any caller's input.

Raising the constant is not a durable answer — any fixed floor can be under-priced later — so the mitigation is on advancing state, not on the bid.

Table of contents verified against headings.