BattleChain Confidence Pools

Summary

The setStakeTokenAllowed function allows the owner to freely add or remove stake tokens from the allowlist. However, there is no tracking of the total number of allowed tokens. This can result in a situation where all tokens are removed, making createPool unusable while the factory contract itself remains active.

Root Cause

The contract uses a mapping:

But it does not:

• Track the total number of allowed tokens

• Prevent removing the last allowed token

• Ensure at least one token remains allowed

As a result, the factory can remain operational (whenNotPaused) but functionally unusable.

Code Snippet-
https://github.com/CodeHawks-Contests/2026-07-bc-confidence-pools/blob/58e8ba4ce3f3277866e4926f3140e597f9554a1e/src/ConfidencePoolFactory.sol#L155

Impact

No new pools can be created (StakeTokenNotAllowed will always revert). The contract appears active but is effectively frozen.