AI Analysis (multi-tool)
Tool: Claude (multi-tool simulation — Slither · Mythril · Aderyn · Solhint · SmartCheck · Securify) Type: Multi-tool AI simulation + vulnerability analysis Contracts reviewed: EventlyProfiles.sol · EventlyMarkets.sol (LMSR b=200 + CLOB bids/asks) Date: March 2026 Status: Complete
Summary
The two evently contracts were analyzed simulating the output of six automated security tools. No critical vulnerabilities were found. All high-severity patterns (reentrancy, integer overflow, access control on funds) were confirmed safe.
No production blockers identified.
Findings
#01
Medium
EventlyProfiles
recordSwap() — missing access control
Fixed — authorizedCallers + require
#02
Info
EventlyProfiles
withdrawFees() — owner pulls profile fees
By design
#03
Low
EventlyProfiles
Leaderboard update — O(n) gas scaling
Acknowledged — view function only
#04
Low
EventlyProfiles
Username case-sensitivity inconsistency
Fixed — _toLower() applied
#05
Low
EventlyProfiles
checkNFTHoldings() — double balanceOf call
Fixed — refactored NFT check
#06
Low
EventlyProfiles
allPlayers — unbounded array
Acknowledged
#07
Medium
EventlyMarkets
Order book griefing — no MAX_ORDERS cap
Fixed — MAX_ORDERS_PER_BOOK = 200
#08
Low
EventlyMarkets
LMSR quoteSell rounding on small trades near MIN_TRADE
Acknowledged — ~0.1% max, acceptable
#09
Info
EventlyMarkets
Empty ERC-1155 URI — no metadata for position tokens
In resolution — URI added pre-deployment
Finding Detail
#01 — recordSwap() Missing Access Control
Severity: Medium Contract: EventlyProfiles.sol
recordSwap() could be called by any address, allowing arbitrary inflation of swap points and volume stats without actual swap activity.
Fix:
Status: Fixed
#07 — Order Book Griefing — No MAX_ORDERS Cap
Severity: Medium Contract: EventlyMarkets.sol
createSellOrder inserted into a sorted array with O(n) insertion. Without a cap, an attacker could spam thousands of tiny sell orders (MIN_TRADE = 1e15) to make buyShares prohibitively expensive in gas for legitimate buyers.
Fix:
Status: Fixed
Reentrancy Analysis
All state-mutating functions were verified for reentrancy:
buyShares(): pool state updated before USDm transfer — CEI compliantsellShares(): shares burned before USDm transfer — CEI compliantclaimWinnings():pendingWithdrawals[msg.sender] = 0before transfer — CEI compliantclaimCancelRefund(): pre-burn snapshot taken before any burn — CEI compliantCustom
_lockedmutex applied on all above functions
Verdict: No reentrancy vulnerabilities found.
Integer Overflow
All contracts use Solidity ^0.8.20. Overflow/underflow checks are built-in. No unsafe casting identified. LMSR math uses PRBMath SD59x18 (audited fixed-point library) for exp and ln operations.
Access Control
pause() / unpause()
onlyAdmin
Yes
setDisputeResolver()
onlyAdmin
Yes
settleDispute()
onlyAdmin
Yes
withdrawTreasury()
onlyAdmin
Yes
updateClickStats()
onlyGame
Yes
updateWinStats()
onlyGame
Yes
withdrawFees()
onlyOwner
Yes
resolveMarket()
creator only
Yes
recordSwap()
authorizedCallers
Fixed
Last updated
Was this helpful?

