Threat Model

Detailed analysis of attack surfaces and mitigations.

Adversary Model

Capabilities

Limitations

Attack Surfaces

1. Instruction-Level Attacks

2. Economic Attacks

3. Protocol-Level Attacks

4. Operational Attacks

Detailed Mitigations

Reentrancy Protection

Solana's runtime provides inherent protection:

1. Account Locking: All accounts locked for transaction
2. No Recursive CPI: Cannot borrow mutably twice
3. No Token Callbacks: Unlike ERC-777, SPL Token has no hooks
4. Idempotency: Settlement checks settled flag first

Oracle Security

Price validation:

fn validate_price(price: &PythPrice, boundary: i64) -> Result<()> {
    // Positive price
    require!(price.price > 0, Error::InvalidPrice);

    // Published after boundary
    require!(price.publish_time >= boundary, Error::StaleOracle);

    // Optional confidence check
    if max_confidence_ratio > 0 {
        let ratio = price.conf * 10000 / price.price.abs();
        require!(ratio <= max_confidence_ratio, Error::ConfidenceTooWide);
    }

    Ok(())
}

Solvency Enforcement

Invariant:

vault.balance >= max(total_yes_shares, total_no_shares)

Audit Findings

Finding 1: Oracle Price Staleness

Concern: Stale Pyth prices could affect resolution.

Status: Mitigated

Mitigation: Sampling Rule A enforces:

• Start snapshot: publish_time >= t_start
• End snapshot: publish_time >= t_end

Finding 2: Settlement Double-Claim

Concern: Users could settle multiple times.

Status: Mitigated

Mitigation: Atomic settled flag:

if position.is_settled() {
    return Ok(()); // No-op
}
// ... calculate payout ...
position.set_settled();

Finding 3: Crank Liveness

Concern: Markets stall if no cranks available.

Status: Accepted Risk

Rationale:

• Permissionless operation
• Incentivized with rewards
• Multiple operators expected
• Force close fallback

Finding 4: Epoch Boundary Race

Concern: Clock drift at boundaries.

Status: Mitigated

Mitigation: Inclusive bounds (>=) prevent gaps.

Finding 5: Price Conversion Precision

Concern: NO to YES conversion precision loss.

Status: Mitigated

Mitigation:

• Exact integer arithmetic
• Protocol-favorable rounding
• Comprehensive test coverage

Known Limitations (v1)

Incident Response

Severity Levels

Response Procedure

1. Detect: Identify the issue
2. Assess: Determine severity and scope
3. Mitigate: Pause if possible
4. Fix: Deploy remediation
5. Disclose: Coordinate public disclosure

Next Steps

• Review Invariants for formal guarantees
• See Architecture Security for implementation