Root + Impact

Description

• a confidence pool is an underwriting market. stakers deposit principal betting the insured agreement survives its term, and on SURVIVED/EXPIRED they recover principal plus a k=2 time-weighted bonus. the pool sponsor bootstraps the market: it creates the pool, seeds an optional bonus to attract deposits, owns the insured agreement, and names recoveryAddress, the destination the whole pool is swept to on a CORRUPTED resolution.

• the sponsor is never required to post any capital of its own that is at risk against the outcome it influences. createPool takes no bond (ConfidencePoolFactory.sol#L67-L113), the bonus is optional and permissionless, and recoveryAddress is sponsor-set and freely mutable (ConfidencePool.sol#L611-L618). this is the core asymmetry: the sponsor owns the in-scope contract yet holds nothing in the pool, so it can deliberately compromise its own in-scope contract to force a CORRUPTED resolution and take the entire pool, which includes 100% of staker principal. any bonus it seeded to attract deposits round-trips back to it in the same resolution, so it underwrites the stakers' bet, profits from the exact event they insured against, and risks nothing, because attacking its own contract has no sponsor stake to slash.

• a CORRUPTED resolution is settled by the moderator as either bad-faith or good-faith, and both classifications route the pool to a party aligned with the sponsor. the sponsor executes the compromise from a fresh, anonymous address it controls: as the unattributable external exploiter that address reads as a bad-faith hack, so a goodFaith=false flag sweeps the pool to recoveryAddress via claimCorrupted (ConfidencePool.sol#L408-L425), and as the address that performed the exploit it is the natural whitehat the moderator names under a goodFaith=true flag, so the whole pool is paid to it via claimAttackerBounty (ConfidencePool.sol#L432-L453). the good-faith recipient need not even be the sponsor's own address: a security researcher colluding with the sponsor can be named instead. either terminal classification the moderator can form from the on-chain facts alone lands the pool at an address the sponsor is aligned with.

Risk

Likelihood:

• at creation every pool leaves the sponsor in control of recoveryAddress with no bond posted, and the sponsor owns the in-scope contract the pool insures.

• the sponsor can drive the agreement to CORRUPTED at a time of its choosing, compromising its own in-scope contract through a subtle flaw only it knows, from an anonymous address it controls, at zero cost because no sponsor capital is held to slash.

• at resolution the moderator sees a genuine external exploit, so either terminal CORRUPTED classification it forms routes the full pool to a sponsor-controlled address.

• once resolved, the full pool moves to a sponsor-controlled address with no gate the sponsor does not already clear: claimCorrupted is permissionless under a bad-faith flag, and claimAttackerBounty is callable by the sponsor's own named address under a good-faith flag. the attempt costs nothing, so it need succeed only once.

Impact:

• total loss of staked principal. on a CORRUPTED resolution the whole pool, including 100% of every staker's deposited principal, is transferred to a sponsor-controlled address, recoveryAddress under a bad-faith flag or the sponsor's named exploiter under a good-faith flag. stakers recover nothing.

• the sponsor profits from attacking its own contract at no downside. because it posts no bond and the optional bonus it seeded round-trips back to it in the same resolution, a sponsor can compromise its own in-scope contract, force the CORRUPTED resolution, and walk away with 100% of the staker principal through an address it controls, having risked none of its own capital on the outcome. its realized cost is 0 and its realized gain is the stakers' principal.

• the mechanism has no aligned party. because the outcome-influencing sponsor holds no slashable capital, nothing in the contract deters it from steering the pool toward CORRUPTED, and the entire downside is borne by stakers.

Proof of Concept

runnable against the project's own harness (test/helpers/BaseConfidencePoolTest.sol), which deploys the pool with moderator as the outcome moderator and the test contract as the owner/sponsor. drop this into test/poc/SponsorNoCollateral.t.sol:

run with forge test --match-path test/poc/SponsorNoCollateral.t.sol -vv:

both terminal CORRUPTED classifications land the full 110_000 pool at a sponsor-controlled address: bad-faith at recoveryAddress, good-faith at the sponsor's own named exploiter. the staker deposits 100_000 and recovers 0 either way, and the sponsor nets exactly the 100_000 of staker principal at zero cost.

Recommended Mitigation

the recommended fix is to discourage a sponsor from attacking its own contract by requiring a sponsor bond that is refundable only when the contract survives. this aligns the sponsor with the stakers: a legitimate sponsor already wants its in-scope contract to remain secure through expiry, so refunding the bond on a SURVIVED or EXPIRED resolution is the expected reward for the sponsor reaching its own goal, and the bonus paid to the stakers is the expected cost of reaching it. forfeiting the bond to the stakers on a CORRUPTED resolution is the penalty for the contract failing, and it removes the sponsor's incentive to induce a CORRUPTED outcome, because attacking its own contract now costs it the bond.

concretely: escrow the bond at pool creation, refund it to the sponsor only on SURVIVED/EXPIRED, and forfeit it to the affected stakers on CORRUPTED, excluded from the recoveryAddress sweep. gate the bond behind an admin-controlled minimum: the factory owner, the same admin that already controls the stake-token allowlist and default moderator, sets and adjusts a minSponsorBond floor so the required coverage tracks expected pool size.