BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Impact: low
Likelihood: medium

SafeHarbor agreement-factory rotation can invalidate legacy agreements and block new pool creation

Author Revealed upon completion

Root + Impact

Description

ConfidencePoolFactory.createPool(...) relies on:

if (!safeHarborRegistry.isAgreementValid(agreement)) revert InvalidAgreement();

But in BattleChain, isAgreementValid is tied to the current s_agreementFactory pointer:

function isAgreementValid(address agreementAddress) external view returns (bool) {
if (s_agreementFactory == address(0)) return false;
return IAgreementFactory(s_agreementFactory).isAgreementContract(agreementAddress);
}

If DAO rotates the registry's factory address via setAgreementFactory(...), agreements created by the previous factory may no longer be recognized by the new factory mapping. Then createPool(...) reverts InvalidAgreement() for those legacy agreements, even if they were previously valid and practical to insure.

Risk

Likelihood:

  • Factory-pointer upgrades/migrations are legitimate operational actions.

  • Validation in createPool is hard-coupled to the registry's current factory pointer.

Impact:

  • DoS of new pool creation for affected legacy agreements.

  • Coverage expansion/new pool rollout can be blocked until off-chain migration/redeployment is completed.

Proof of Concept

// 1) Agreement A is deployed by FactoryV1
// 2) Registry initially points to FactoryV1 => isAgreementValid(A) == true
// 3) Governance rotates registry factory: setAgreementFactory(FactoryV2)
// 4) FactoryV2 does not recognize A in its isAgreementContract mapping
// 5) ConfidencePoolFactory.createPool(..., agreement = A, ...) now reverts InvalidAgreement()

Recommended Mitigation

Support legacy-agreement validity across factory migrations, e.g.:

  1. Keep a whitelist/set of previously accepted factory addresses in the registry, or

  2. Keep an explicit legacy agreement allowlist during migration windows.

Either approach preserves createPool liveness for agreements that were valid under prior official factory versions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!