AI Analysis (multi-tool)

Tool: Claude (multi-tool simulation — Slither · Mythril · Aderyn · Solhint · SmartCheck · Securify) Type: Multi-tool AI simulation + vulnerability analysis Contracts reviewed: EventlyProfiles.sol · EventlyMarkets.sol (LMSR b=200 + CLOB bids/asks) Date: March 2026 Status: Complete

---

Summary

The two evently contracts were analyzed simulating the output of six automated security tools. No critical vulnerabilities were found. All high-severity patterns (reentrancy, integer overflow, access control on funds) were confirmed safe.

No production blockers identified.

---

Findings

ID	Severity	Contract	Title	Status
#01	Medium	EventlyProfiles	recordSwap() — missing access control	Fixed — authorizedCallers + require
#02	Info	EventlyProfiles	withdrawFees() — owner pulls profile fees	By design
#03	Low	EventlyProfiles	Leaderboard update — O(n) gas scaling	Acknowledged — view function only
#04	Low	EventlyProfiles	Username case-sensitivity inconsistency	Fixed — _toLower() applied
#05	Low	EventlyProfiles	checkNFTHoldings() — double balanceOf call	Fixed — refactored NFT check
#06	Low	EventlyProfiles	allPlayers — unbounded array	Acknowledged
#07	Medium	EventlyMarkets	Order book griefing — no MAX_ORDERS cap	Fixed — MAX_ORDERS_PER_BOOK = 200
#08	Low	EventlyMarkets	LMSR quoteSell rounding on small trades near MIN_TRADE	Acknowledged — ~0.1% max, acceptable
#09	Info	EventlyMarkets	Empty ERC-1155 URI — no metadata for position tokens	In resolution — URI added pre-deployment

---

Finding Detail

#01 — recordSwap() Missing Access Control

Severity: Medium Contract: EventlyProfiles.sol

recordSwap() could be called by any address, allowing arbitrary inflation of swap points and volume stats without actual swap activity.

Fix:

modifier onlyAuthorized() {
    require(authorizedCallers[msg.sender], "Not authorized");
    _;
}
function recordSwap(address player, uint256 volumeUsdCents) external onlyAuthorized { ... }

Status: Fixed

---

#07 — Order Book Griefing — No MAX_ORDERS Cap

Severity: Medium Contract: EventlyMarkets.sol

createSellOrder inserted into a sorted array with O(n) insertion. Without a cap, an attacker could spam thousands of tiny sell orders (MIN_TRADE = 1e15) to make buyShares prohibitively expensive in gas for legitimate buyers.

Fix:

uint256 public constant MAX_ORDERS_PER_BOOK = 200;
// in createSellOrder:
require(_orderBook[_marketId][_opt].length < MAX_ORDERS_PER_BOOK, "Order book full");

Status: Fixed

---

Reentrancy Analysis

All state-mutating functions were verified for reentrancy:

• buyShares(): pool state updated before USDm transfer — CEI compliant
• sellShares(): shares burned before USDm transfer — CEI compliant
• claimWinnings(): pendingWithdrawals[msg.sender] = 0 before transfer — CEI compliant
• claimCancelRefund(): pre-burn snapshot taken before any burn — CEI compliant
• Custom _locked mutex applied on all above functions

Verdict: No reentrancy vulnerabilities found.

---

Integer Overflow

All contracts use Solidity ^0.8.20. Overflow/underflow checks are built-in. No unsafe casting identified. LMSR math uses PRBMath SD59x18 (audited fixed-point library) for exp and ln operations.

---

Access Control

Function	Protected	Verified
pause() / unpause()	onlyAdmin	Yes
setDisputeResolver()	onlyAdmin	Yes
settleDispute()	onlyAdmin	Yes
withdrawTreasury()	onlyAdmin	Yes
updateClickStats()	onlyGame	Yes
updateWinStats()	onlyGame	Yes
withdrawFees()	onlyOwner	Yes
resolveMarket()	creator only	Yes
recordSwap()	authorizedCallers	Fixed