BattleChain Confidence Pools

Summary

The pool owner can call setRecoveryAddress() at any time, including after users have deposited funds. This lets the owner
replace the configured recovery destination before a recovery-path settlement.

The updated address receives funds from bad-faith CORRUPTED settlements, expired attacker bounties, and unclaimed bonus
sweeps.

Impact

A malicious or compromised owner can redirect recovery-path funds to an arbitrary address.

Severity: Low, as it requires the trusted pool owner.

POC test

function testOwnerCanRedirectRecoveryFunds() external {
uint256 amount = 100e18;
address maliciousRecovery = makeAddr("maliciousRecovery");

}

Mitigation

Lock recoveryAddress after the first stake, or require address updates to pass through a timelock.

function setRecoveryAddress(address newRecoveryAddress) external onlyOwner {
if (expiryLocked) revert RecoveryAddressLocked();
if (newRecoveryAddress == address(0)) revert InvalidRecoveryAddress();

}