Locked pool scope can be detached from the original agreement and rebound elsewhere

Description

A pool's locked scope should continue tracking the risk lifecycle for the covered account. The pool validates scope membership against the original immutable agreement and later reads only that original agreement's registry state. If the scoped account is removed from Agreement A and rebound to Agreement B, the pool remains blind to B's CORRUPTED state.

Vulnerability Details

The pool reads state only for the original agreement:

Scope replacement checks membership against the same immutable agreement:

After the pool's scope locks, the agreement owner can remove the account from Agreement A and bind it to Agreement B. If Agreement B becomes corrupted while Agreement A remains non-terminal, the pool cannot observe the corrupted lifecycle for the covered account.

Impact

The moderator cannot mark the pool CORRUPTED for a corruption affecting the covered account under its new agreement binding.

The pool can resolve EXPIRED and pay stakers even though the covered account is corrupted elsewhere in the registry graph.

Proof of Concept

Recommended Mitigation

Track the current state for locked scope accounts instead of only the immutable original agreement state.

The resolution logic should handle account migration explicitly, or prevent migration from invalidating the pool's locked risk source.