Root + Impact

Description

After a successful in-scope attack, the upstream AttackRegistry must first be changed to CORRUPTED. The ConfidencePool moderator can then mark the pool as good-faith CORRUPTED and assign the pool bounty to the whitehat.

The Agreement owner is assigned as the initial AttackRegistry moderator when the Agreement is registered:

The attack moderator publishes a successful attack by calling markCorrupted():

This creates a gap between a real exploit and the on-chain CORRUPTED signal. During that gap, the ConfidencePool moderator cannot flag the correct outcome. flagOutcome(CORRUPTED) requires the upstream state to already be CORRUPTED:

At the pool expiry, anyone can call claimExpired(). When the registry still reports UNDER_ATTACK or PROMOTION_REQUESTED, the function resolves the pool as EXPIRED and immediately sets claimsStarted:

The sponsor can therefore delay markCorrupted() until after claimExpired():

1. A whitehat completes a successful in-scope attack shortly before the pool expiry.

2. The sponsor still controls the upstream attack-moderator role and leaves the Agreement as UNDER_ATTACK.

3. The sponsor can do it to not pay an attacker at all or to save his own staked amount in the confidence pool.

4. At expiry, the sponsor or any other account calls claimExpired().

5. The pool becomes EXPIRED, starts claims, and pays stakers.

6. The sponsor publishes the real CORRUPTED state afterward.

7. The pool moderator tries to flag good-faith CORRUPTED, but the call reverts with OutcomeAlreadySet.

8. The whitehat receives nothing from the ConfidencePool.

There is no point where the pool moderator can apply the correct result:

If the sponsor contributed a bonus, then the sponsor can also recover most of its own bonus when the pool has not observed the risk window before the final minute. A large sponsor stake becomes the first observation, which clamps all earlier stakes to the same effective entry time. The k=2 time factor is then equal for all stakers, so the bonus is split by stake amount.

For example:

The sponsor owns 99% of the total stake and receives 99% of the bonus. The whitehat receives zero from the ConfidencePool. This bonus recovery is an impact amplifier, it is not required for the incorrect expiry result.

Risk

Likelihood:

• A successful in-scope attack must occur shortly before the pool expiry.

• The pool must still be unresolved when expiry is reached.

• The upstream state must remain UNDER_ATTACK or PROMOTION_REQUESTED until claimExpired() executes.

• Deliberate sponsor control requires the sponsor to still hold the AttackRegistry moderator role, which is the default assignment but can be transferred.

Impact:

• A good-faith whitehat can lose the entire ConfidencePool bounty.

• The pool pays stakers under EXPIRED even though a covered attack succeeded before expiry.

• With an unobserved risk window and enough capital, the sponsor can recover most of the bonus through a late stake.

• The separate Safe Harbor Agreement bounty is not affected by this finding.

Proof of Concept

Add the following test to test/unit/DelayedCorruptionExpiry.t.sol and run:

Recommended Mitigation

One practical fix is to add a short post-expiry challenge window so an unresolved pool cannot immediately pay out while the Agreement is still attackable.