The factory validates agreement ownership only when a pool is created. After creation, the pool remains owned by the original creator even if the underlying agreement ownership changes later.
This creates an authority drift between the current agreement owner and the address still controlling the existing confidence pool.
If agreement ownership changes after pool creation, the existing pool owner is not updated. The original creator can still control pool-local parameters even after they are no longer the agreement owner.
Medium.
This can occur when an agreement owner creates a pool and the agreement ownership is later transferred or changed.
Medium.
An existing pool can remain controlled by the original sponsor after the related agreement has moved to a different owner.
This can affect pool-local configuration and settlement-related parameters, including recovery destination, expiry configuration before lock, and scope configuration before lock.
# Proof of Concept
Relevant test:
`testAgreementOwnerDriftDoesNotMoveExistingPoolOwnership()`
Minimal test logic:
```solidity
function testAgreementOwnerDriftDoesNotMoveExistingPoolOwnership() public {
address originalOwner = address(this);
ConfidencePool pool = factory.createPool(
agreement,
address(token),
recovery,
expiry,
minStake,
initialScope
);
assertEq(pool.owner(), originalOwner);
address newAgreementOwner = address(0xBEEF);
mockAgreement.transferOwnership(newAgreementOwner);
assertEq(mockAgreement.owner(), newAgreementOwner);
assertEq(pool.owner(), originalOwner);
assertNotEq(pool.owner(), mockAgreement.owner());
pool.setRecoveryAddress(address(0xCAFE));
assertEq(pool.recoveryAddress(), address(0xCAFE));
}
Command:
forge test --match-path "test/internal/*" -vvv
Observed output:
The PoC proves the following state transition:
```text
agreement.owner() changes from originalOwner to newAgreementOwner
pool.owner() remains originalOwner
originalOwner can still call pool-level authority functions
[PASS] testAgreementOwnerDriftDoesNotMoveExistingPoolOwnership()
Suite result: ok.
Minimal scenario:
The agreement owner creates a confidence pool through the factory.
The pool is initialized with the creator as the pool owner.
The agreement ownership changes later.
The existing pool owner does not change.
The original creator remains the controller of pool-local parameters.
Expected behavior:
After agreement ownership changes, the authority relationship between the agreement and the linked pool should remain consistent.
Observed behavior:
The pool owner remains the original creator even after the agreement ownership changes. The new agreement owner does not automatically receive control over the already-created confidence pool.
## Recommended Mitigation
The pool lifecycle should preserve a clear authority relationship between agreement ownership and pool-level control.
A safe fix should ensure that authority-sensitive pool parameters cannot remain silently controlled by an address whose relationship to the agreement has changed in a way that affects expected control.
```diff
- Agreement ownership is validated only at pool creation.
- Existing pool control can remain with the original creator after agreement ownership changes.
+ Preserve a consistent authority relationship between the agreement owner and the linked pool controller.
+ Prevent silent authority drift for agreement-linked pool parameters.
```
A regression test should cover an agreement ownership change after pool creation and verify that the pool authority model remains consistent.
