Security Overview

Approach

evently's security process is structured in three phases:

Phase 1 — AI audits (7 engines) + automated tools    ← completed
Phase 2 — Professional third-party audit              ← two independent firms scheduled
Phase 3 — Ongoing monitoring + bug bounty             ← post-launch

All findings, fixes, and the contracts reviewed at each stage are documented publicly in this documentation and in the GitHub repository.

---

AI Security Audits

All evently contracts underwent multi-round security review using 7 AI engines with a 3-round methodology (Systematic review → Economic analysis → Triage). The contracts reviewed are: EventlyProfiles.sol v1.3 and EventlyMarkets.sol (LMSR, b=200).

AI Tool	Contracts	Findings	Status
Claude Opus 4.6	EventlyMarkets · Profiles v1.3	6	All resolved or acknowledged
GPT-4o	EventlyMarkets · Profiles v1.3	13	All resolved or acknowledged
Gemini 1.5 Pro	EventlyMarkets · Profiles v1.3	9	All resolved or acknowledged
Grok (xAI)	EventlyMarkets · Profiles v1.3	6	All resolved or acknowledged
DeepSeek R1	EventlyMarkets · Profiles v1.3	7	All resolved or acknowledged
Qwen3.5	EventlyMarkets · Profiles v1.3	4	All resolved or acknowledged
Perplexity	EventlyMarkets · Profiles v1.3	—	All resolved or acknowledged

All 7 AI engines reviewed EventlyMarkets (LMSR). Key cross-tool findings documented in Consolidated AI Audit.

---

Automated Tool Scans

22 automated security tools completed, following the methodology recommended by z0r0z/majeur. Individual reports are linked in the Audit Reports section.

---

Third-Party Audits

Two independent professional audits are scheduled for Q2 2026. Firms were selected based on availability, scope fit, and budget. Formal audit reports will be published here upon completion.

---

Security Properties

Reentrancy

Fund-moving functions use a custom inline nonReentrant mutex (_locked flag — not the OZ import). CEI (Checks-Effects-Interactions) enforced throughout. All AI audits confirmed: 0 reentrancy vulnerabilities found in active paths. nonReentrant added to resolveMarket, cancelMarket, slashMarket, claimCreatorFees, reclaimCancelledOrder .

Pull Payment

All payouts use pull-payment: winners call redeemWinnings(), cancelled-market holders call claimCancelRefund(), creators call claimCreatorFees(). No push to arbitrary addresses. Lazy refund for cancelled CLOB orders via reclaimCancelledOrder().

Treasury Resilience

Treasury fees accumulate in treasuryBalance (no external transfer on every trade). Withdrawals are two-step with a 24-hour timelock: requestTreasuryWithdrawal() → wait 24h → executeTreasuryWithdrawal(). Admin can cancel before execution. Prevents rug-pull .

Access Control

Modifier	Who	Used on
onlyAdmin	Admin multisig	Slash, pause, ban, whitelist management, treasury, admin cancel
onlyDisputeResolver	Dedicated resolver address	settleDispute() only
onlyMarketCreator	marketCreatorWhitelisted[addr] or admin	createMarket, createImportedMarket
onlyWhitelisted	whitelisted[addr]	Trading functions (beta only; disabled at public launch)
whenNotPaused	—	All trading and market creation

Admin and disputeResolver are separate roles — admin cannot unilaterally settle disputes. Resolver pool address changes are also timelocked (24h).

Emergency Controls

Pause: pause() (admin only). Blocks all trading and market creation via whenNotPaused. Auto-expires after 72 hours (MAX_PAUSE_DURATION). After expiry, anyone can call unpause() — prevents permanent lockout by a compromised admin key.

Ban: banAddress(addr) / unbanAddress(addr) (admin only). Banned addresses cannot call any market function. Used to remediate griefing addresses without affecting other users.

Admin Cancel Orders: adminCancelOrders(orderIds[]) — force-cancels resting CLOB orders; escrowed funds returned to original owners. Used when a banned address has open orders.

Mandatory Evidence Hashes

Both resolveMarket() and settleDispute() require a non-zero bytes32 evidenceHash. Emitted via ResolutionEvidence(marketId, submitter, hash) event. Provides an immutable on-chain audit trail linking every resolution to an off-chain evidence document.

Mandatory Resolution

cancelMarket is blocked if the market has any trading activity (totalVolume > 0 or active resting orders) until resolutionDeadline passes. Prevents creators from quietly cancelling active markets to avoid adverse outcomes.

LMSR Solvency

Mathematically proven by construction: poolBalance + subsidyDeposited >= total winning shares at all times. The LMSR cost function is monotone — buying shares always increases the pool by at least the payout obligation.

conditionId Validation

Imported Polymarket condition IDs are validated as exactly 66 characters, 0x-prefixed, lowercase hex [0-9a-f] only. Prevents case-aliased duplicates from bypassing the keccak256 deduplication guard.

No Upgradeability

Contracts are immutable. No proxy pattern. Any upgrade requires a new deployment with migration.

---

Known Design Choices

Item	Decision	Rationale
Single disputeResolver	Centralization risk	Separate from admin; planned upgrade to validator council post-TGE (Megavalidators NFT governance)
Fixed 2.5% fee	Not configurable	Prevents admin fee manipulation; constants audited
Trader whitelist disabled at launch	Open trading	Creator whitelist always active as quality gate
LMSR b = 200 USDm fixed	Not per-market	Simplifies solvency proof; configurable b roadmapped for V4
Creator collateral 50 USDm	Fixed	Dynamic collateral scaling deprioritized; admin ban provides secondary deterrent
ERC-1155 pre-resolution transfers	No restriction hook	Positions technically transferable. optionSupply tracks total minted, not per-wallet.
Admin multisig	Gnosis Safe	Planned post-raise. Single-sig admin is acknowledged risk during beta.