BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: high

Permissionless pokeRiskWindow Permanently Disables Withdrawals

Author Revealed upon completion

Root + Impact

The public pokeRiskWindow function is permissionless and can be called by any address. If the agreement is in an active‑risk state, this call sets the one‑way riskWindowStart latch, which permanently disables withdrawals for all stakers without the attacker needing any stake or privilege.

Description

  • pokeRiskWindow is a public utility that allows anyone to force the pool to observe the current registry state and update its risk‑window markers.

  • A malicious actor with no stake can call pokeRiskWindow while the agreement is in an active‑risk state (UNDER_ATTACK or PROMOTION_REQUESTED). This sets the one‑way riskWindowStart latch, permanently disabling withdrawals for all stakers.

// src/ConfidencePool.sol pokeRiskWindow()
function pokeRiskWindow() external {
if (outcome != PoolStates.Outcome.UNRESOLVED) return;
_observePoolState(); // @> Permissionless; can seal riskWindowStart
// ...
}
​
// src/ConfidencePool.sol _observePoolState()
if (riskWindowStart == 0 && _isActiveRiskState(state)) {
_markRiskWindowStart(); // @> Sets riskWindowStart, disabling withdrawals
}
​
// src/ConfidencePool.sol withdraw()
if (riskWindowStart != 0 || (state not pre‑attack)) {
revert WithdrawsDisabled(); // @> Withdrawals permanently locked
}

Risk

Likelihood:

  • Any external account can call pokeRiskWindow at any time while the agreement is in UNDER_ATTACK or PROMOTION_REQUESTED.

  • The attacker needs no stake, no privileges, and incurs only gas costs

Impact:

  • All stakers lose the ability to withdraw early, even if the registry later returns to a safe state.

  • Funds are not stolen, but the forced lock‑up can cause significant financial damage (missed opportunities, liquidations elsewhere).

Proof of Concept

Explanation:

A pool is created and a staker deposits 100 tokens. The agreement is already UNDER_ATTACK. A griefer with no stake calls pokeRiskWindow, which forces the observation of the active‑risk state and sets riskWindowStart. The staker then attempts to withdraw but the call reverts with WithdrawsDisabled. The griefer needed no funds or privileges; the lock is immediate and permanent.

function test_M3_PokeRiskWindowGrief() public {
MockRegistry registry = new MockRegistry();
registry.setAgreementState(agreement, IAttackRegistry.ContractState.UNDER_ATTACK);
​
address sponsor = makeAddr("sponsor");
address staker = makeAddr("staker");
address griefer = makeAddr("griefer");
​
vm.prank(sponsor);
ConfidencePool pool = factory.createPool(agreement, address(stakeToken), expiry, minStake, sponsor, accounts);
​
deal(address(stakeToken), staker, 100 ether);
vm.startPrank(staker);
stakeToken.approve(address(pool), 100 ether);
pool.stake(100 ether);
vm.stopPrank();
​
vm.prank(griefer);
pool.pokeRiskWindow();
​
vm.prank(staker);
vm.expectRevert(IConfidencePool.WithdrawsDisabled.selector);
pool.withdraw();
}

Recommended Mitigation

Mitigation explanation:

The fix restricts pokeRiskWindow to addresses that hold an active stake (eligibleStake[msg.sender] > 0). This aligns the permission with those who have skin in the game stakers are the ones most incentivised to keep the risk window open or closed correctly.

A random griefer with no funds in the pool can no longer lock everyone’s withdrawals for free. A secondary option is to add a short time‑delay: after pokeRiskWindow seals the latch, withdrawals could remain open for a final N blocks, giving honest stakers a last‑chance exit before the lock becomes permanent.

- function pokeRiskWindow() external {
+ function pokeRiskWindow() external {
+ require(eligibleStake[msg.sender] > 0, "Only stakers can seal risk window");
// rest unchanged
+ }
​
+ // Alternatively, add a time‑delay: after pokeRiskWindow, keep withdrawals open for N blocks.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!