GPT-5.3

GPT-5.3 --- Security Report

Tool: GPT-5.3 Type: 3-round AI audit (Systematic → Economic → Triage) Contracts reviewed: EventlyProfiles.sol · EventlyMarkets.sol (LMSR b=200 + CLOB bids/asks) Chain: MegaETH (Chain ID 4326) --- Solidity ^0.8.20 Date: March 2026 Status: Complete

---

Summary

The evently system is generally well-structured and follows several good security practices (custom reentrancy guard, CEI ordering, pull-payments fallback, and fee accounting). No critical reentrancy or solvency vulnerabilities were identified.

However 3 notable findings were discovered: - 1 High severity - 2 Medium severity

The High severity issue relates to a dispute settlement imbalance in EventlyMarkets that can lead to protocol-level token loss.

---

Findings

---

ID Severity Contract Title Status

---

F-01 High EventlyMarkets Dispute payout Implemented can exceed available collateral

F-02 Medium EventlyMarkets Creator can By design resolve market dishonestly before dispute

F-03 Medium EventlyProfiles Username case Fixed — _toLower() applied normalization inconsistency

---

Round 1 --- Systematic Review

Reentrancy

EventlyMarkets implements a manual reentrancy lock (_locked) protecting external entrypoints such as:

• buyShares
• sellShares
• placeBid
• placeAsk
• settleDispute
• claimWinnings
• claimRefund
• claimSlashedRefund

Example:

pendingWithdrawals[msg.sender] = 0;
usdm.safeTransfer(msg.sender, amt);

State changes occur before external calls, preventing reentrancy exploits.

Verdict: Safe implementation

---

Access Control

Key protected functions:

• pause
• unpause
• setDisputeResolver
• settleDispute
• distributeMonthlyDisputeRewards

Profiles contract uses onlyGame modifier, and Markets contract uses onlyAdmin.

Market resolution is controlled by the market creator:

require(msg.sender == m.creator, "Only creator");

This is a trust assumption rather than a vulnerability.

---

Integer Arithmetic

Solidity ^0.8 prevents overflow.

Examples reviewed:

(uint256 distributablePool * userBet) / winningPool

(treasuryGain * DISPUTE_REWARD_SHARE_BPS) / 10000

Dust may occur due to integer division but is negligible.

Verdict: Safe

---

Logic & State

Username normalization issue

Profile creation:

usernameTaken[_username] = true;
usernameToAddress[lowerUsername] = msg.sender;

Case-sensitive duplicates possible (Alice vs alice), leading to inconsistent lookups.

---

Denial of Service

CLOB bid/ask arrays are bounded by practical market size. getLeaderboard and other view functions iterate across all players but are view-only, therefore safe.

---

Front-running / MEV

Expected in:

• Prediction market betting
• CLOB order matching

No exploitable contract logic issues found.

---

Round 2 --- Economic Analysis

Market Solvency

LMSR invariant maintained via b parameter (cost function bounded). Creator collateral posted at market creation ensures resolution incentives exist.

Verdict: Markets remain solvent.

---

Dispute Economics

Disputes require 50 USDM collateral from disputer.

DISPUTE_COLLATERAL = 50e18

Economic protection against frivolous disputes exists.

---

Referral Sybil Vectors

Mitigation exists:

REFERRAL_ACTIVATION_THRESHOLD = 0.01 ether

Attack still possible but economically inefficient.

---

Market Creator Advantage

Creator resolves markets but disputes require collateral (50 tokens), creating economic protection.

---

Treasury Risks

Treasury controlled by admin key.

Worst-case scenario: treasury drained but markets continue operating.

---

Round 3 --- Triage

F-01 --- Dispute payout imbalance (High)

Bug:

usdm.safeTransfer(m.disputer, DISPUTE_COLLATERAL + 25e18);

Contract only receives 50 tokens but sends 75, causing protocol loss.

Fix

function settleDispute(uint256 _marketId, bool _creatorWasRight) external onlyAdmin {
    Market storage m = markets[_marketId];
    require(m.status == MarketStatus.Disputed, "Not disputed");

    if (_creatorWasRight) {
        treasuryBalance += DISPUTE_COLLATERAL;
    } else {
        usdm.safeTransfer(m.disputer, DISPUTE_COLLATERAL);
        m.winningOption = m.disputeOption;
        m.creatorCollateralReturned = true;
        m.creatorFeePaid = true;
    }

    m.status = MarketStatus.Finalized;
    _emitFinalized(_marketId);
}

---

F-02 --- Dishonest creator resolution

Creator can resolve incorrectly before dispute.

Classification: Design Tradeoff

---

F-03 --- Username normalization bug

Recommended fix:

string memory lowerUsername = _toLower(_username);

require(!usernameTaken[lowerUsername], "Username taken");

usernameTaken[lowerUsername] = true;
usernameToAddress[lowerUsername] = msg.sender;

---

Reentrancy Surface Summary

Function Guard CEI Verdict

---

buyShares nonReentrant Yes Safe sellShares nonReentrant Yes Safe placeBid nonReentrant Yes Safe placeAsk nonReentrant Yes Safe settleDispute nonReentrant Yes Safe claimWinnings nonReentrant Yes Safe claimRefund None Yes Safe claimSlashedRefund None Yes Safe

---

Severity scale: Critical / High / Medium / Low / Informational Status options: In resolution | By design | Acknowledged | Frontend handles | False positive