Root + Impact

The outcomeModerator address is set in the initiliaze(...) function of the Confidence Pool, but this role can't be transferred to another address. A potential issue with the outcomeModerator means that it won't be able to correctly flagOutcome(...) and in a potential CORRUPTED end state, the claimExpired() will eventually get called and set the state to EXPIRED.

Description

The ConfidencePoolFactory contract implements functionality to change the defaultOutcomeModerator address, which is passed in the deployment of each pool. An issue with the defaultOutcomeModerator which requires a change of the address means that there will be active Confidence Pools with the old address.

Risk

Likelihood:

When ConfidencePoolFactory contract needs to change the defaultOutcomeModerator address.

Impact:

All live pools are stuck with old moderator address, potentially unable to flag a CORRUPTED outcome.

Proof of Concept

Recommended Mitigation

Consider implementing a function to allow transferring of the outcome moderator in each pool.