Consolidated AI Audit

Contract: EventlyMarkets.sol · EventlyProfiles.sol v1.3 Chain: MegaETH (Chain ID 4326) · Solidity ^0.8.20 Methodology: 7 AI engines × 3-round audit (vulnerability scan → economic analysis → triage)

---

Audit Summary

AI Tool	Scope	Findings	Blocking
Claude Opus 4.6	EventlyMarkets + Profiles	6	0
GPT-4o	EventlyMarkets + Profiles	13	0
Gemini 1.5 Pro	EventlyMarkets + Profiles	9	0
Grok (xAI)	EventlyMarkets + Profiles	6	0
DeepSeek R1	EventlyMarkets + Profiles	7	0
Qwen3.5	EventlyMarkets + Profiles	4	0
Perplexity	EventlyMarkets + Profiles	—	0
Total		45+	0

No production blockers identified across all 7 engines.

---

Cross-Tool Consensus — Acknowledged by Design

The following findings were raised by multiple tools independently. All are acknowledged design decisions, not vulnerabilities.

Finding	Tools	Decision
optionSupply not updated on peer ERC-1155 transfers	Claude, GPT-4o	By design — tracks total minted; math correct for all payout paths
LMSR exp() overflow threshold at q/b ≈ 133	Qwen, GPT-4o	Cap enforced on-chain (EXP_MAX_ARG), documented in NatSpec
quoteBuy binary search conservative flooring	Claude, Grok, DeepSeek	< 0.001 share impact per trade; acceptable
closeBetting permissionless	Gemini	By design — requires deadline elapsed; anyone can advance lifecycle
Fee rounding dust always favours resolver	Gemini	Intentional — 1-wei dust absorbed by resolver cut
Single admin key — centralization risk	Multiple	Gnosis Safe multisig post-raise; acknowledged for beta

---

Disputed / False Positives

Tool	Finding	Verdict
GPT-4o	"LMSR pool + subsidy may not cover max winning payout"	False positive — LMSR solvency mathematically proven: poolBalance + subsidyDeposited = C(q) ≥ q_winner. Every winning share backed 1:1.
GPT-4o	"optionSupply desync causes over-refunds on cancel"	False positive — claimCancelRefund uses pre-burn snapshot; optionSupply updated on burn; peer transfers don't affect cancel refund math.
Gemini	"P2P shares create insolvency gap"	Not applicable — contract uses CLOB (bids + asks), not P2P. CLOB fills use escrowed assets; no insolvency gap.
DeepSeek	"Virtual pool underflow on extreme buys"	Not applicable — virtual pool model replaced by LMSR.

---

Acknowledged — Minor / Informational

ID	Contract	Finding	Status
A-01	EventlyMarkets	quoteSell rounding loss near MIN_TRADE (~0.1% max)	Acknowledged
A-02	EventlyMarkets	optionSupply not updated on peer ERC-1155 transfers	Acknowledged — by design
A-04	EventlyMarkets	Empty ERC-1155 URI	URI added pre-deployment
A-05	EventlyMarkets	_cancelAllOrders gas bound on L1-like chains	MegaETH REX4 gas guards in place
A-06	EventlyMarkets	whitelistedCount never read on-chain	Informational — off-chain indexing
F-01	EventlyProfiles	setAuthorizedCaller always set true	Fixed in v1.3

---

Reentrancy Analysis (Consolidated)

All 7 audits confirmed zero exploitable reentrancy in active trading paths.

Function group	Guard
placeOrder, sellToAMM, cancelOrder	nonReentrant + CEI
redeemWinnings, claimCancelRefund, claimCreatorFees	nonReentrant + CEI
disputeMarket, settleDispute	nonReentrant + CEI
resolveMarket, cancelMarket, slashMarket	nonReentrant + CEI
reclaimCancelledOrder	nonReentrant + CEI
All state-mutating admin functions	nonReentrant + CEI

Consensus: 0 reentrancy vulnerabilities in active paths.

---

Economic Analysis — LMSR Solvency

Verdict: SOLVENT — proven by construction.

• poolBalance + subsidyDeposited = C(q) ≥ max(q[i]) = q_winner at all times
• 1 winning share redeems for exactly 1 USDm — no pro-rata rounding
• CLOB fills use escrowed USDm (BUY) or escrowed shares (SELL) — AMM pool unaffected by CLOB matching
• Cancel refund pool: poolBalance + subsidyDeposited — subsidy recoverable by shareholders

No economic attack vector identified by any of the 7 engines.

---

Architecture Overview

EventlyMarkets combines three trading layers:

Layer	Role
LMSR AMM (b=200 USDm)	Permanent market maker; baseline liquidity; market maker of last resort
CLOB Bids	Resting buy limit orders matched against incoming SELL orders
CLOB Asks	Resting sell limit orders matched against incoming BUY budget

Price-time priority. Max 200 orders per (market, option, side). Max 10 active orders per user per market.

---

This document consolidates AI pre-audit findings. It does not replace a professional security audit.