`stake()` locks expiry permanently on the first stake, allowing a malicious user to abuse withdraw and deny owner expiry updates.
Details
In src/ConfidencePool.sol, stake() sets expiryLocked = true when the first stake occurs:
A user can perform a minimal stake and then immediately call withdraw(), leaving expiryLocked true. That state permanently blocks setExpiry() because it reverts when expiryLocked is set.
Impact
Owner cannot update the pool expiry after the first stake, even when scope changes or a valid extension is needed.
This can freeze owner maintenance and lock the contract into an invalid lifecycle.
Malicious user can keep doing this on all pools being deployed by an aggreement or in the protocal making the expiry update feature totally useless
Recommendation Mitigation
Consider unlocking expiry updates for cases where a withdraw makes total stake become zero
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.