> For the complete documentation index, see [llms.txt](https://docs.evently.market/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.evently.market/security/pre-audit-consolidated.md). # Consolidated AI Audit **Contract:** EventlyMarkets.sol · EventlyProfiles.sol v1.3 **Chain:** MegaETH (Chain ID 4326) · Solidity ^0.8.20 **Methodology:** 7 AI engines × 3-round audit (vulnerability scan → economic analysis → triage) *** ## Audit Summary | AI Tool | Scope | Findings | Blocking | | --------------- | ------------------------- | -------- | -------- | | Claude Opus 4.6 | EventlyMarkets + Profiles | 6 | 0 | | GPT-4o | EventlyMarkets + Profiles | 13 | 0 | | Gemini 1.5 Pro | EventlyMarkets + Profiles | 9 | 0 | | Grok (xAI) | EventlyMarkets + Profiles | 6 | 0 | | DeepSeek R1 | EventlyMarkets + Profiles | 7 | 0 | | Qwen3.5 | EventlyMarkets + Profiles | 4 | 0 | | Perplexity | EventlyMarkets + Profiles | — | 0 | | **Total** | | **45+** | **0** | **No production blockers identified across all 7 engines.** *** ## Cross-Tool Consensus — Acknowledged by Design The following findings were raised by multiple tools independently. All are acknowledged design decisions, not vulnerabilities. | Finding | Tools | Decision | | ----------------------------------------------------- | ---------------------- | ------------------------------------------------------------------- | | `optionSupply` not updated on peer ERC-1155 transfers | Claude, GPT-4o | By design — tracks total minted; math correct for all payout paths | | LMSR `exp()` overflow threshold at `q/b ≈ 133` | Qwen, GPT-4o | Cap enforced on-chain (`EXP_MAX_ARG`), documented in NatSpec | | `quoteBuy` binary search conservative flooring | Claude, Grok, DeepSeek | < 0.001 share impact per trade; acceptable | | `closeBetting` permissionless | Gemini | By design — requires deadline elapsed; anyone can advance lifecycle | | Fee rounding dust always favours resolver | Gemini | Intentional — 1-wei dust absorbed by resolver cut | | Single admin key — centralization risk | Multiple | Gnosis Safe multisig post-raise; acknowledged for beta | *** ## Disputed / False Positives | Tool | Finding | Verdict | | -------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | GPT-4o | "LMSR pool + subsidy may not cover max winning payout" | **False positive** — LMSR solvency mathematically proven: `poolBalance + subsidyDeposited = C(q) ≥ q_winner`. Every winning share backed 1:1. | | GPT-4o | "`optionSupply` desync causes over-refunds on cancel" | **False positive** — `claimCancelRefund` uses pre-burn snapshot; `optionSupply` updated on burn; peer transfers don't affect cancel refund math. | | Gemini | "P2P shares create insolvency gap" | **Not applicable** — contract uses CLOB (bids + asks), not P2P. CLOB fills use escrowed assets; no insolvency gap. | | DeepSeek | "Virtual pool underflow on extreme buys" | **Not applicable** — virtual pool model replaced by LMSR. | *** ## Acknowledged — Minor / Informational | ID | Contract | Finding | Status | | ---- | --------------- | ------------------------------------------------------ | ---------------------------------- | | A-01 | EventlyMarkets | `quoteSell` rounding loss near MIN\_TRADE (\~0.1% max) | Acknowledged | | A-02 | EventlyMarkets | `optionSupply` not updated on peer ERC-1155 transfers | Acknowledged — by design | | A-04 | EventlyMarkets | Empty ERC-1155 URI | URI added pre-deployment | | A-05 | EventlyMarkets | `_cancelAllOrders` gas bound on L1-like chains | MegaETH REX4 gas guards in place | | A-06 | EventlyMarkets | `whitelistedCount` never read on-chain | Informational — off-chain indexing | | F-01 | EventlyProfiles | `setAuthorizedCaller` always set true | Fixed in v1.3 | *** ## Reentrancy Analysis (Consolidated) All 7 audits confirmed zero exploitable reentrancy in active trading paths. | Function group | Guard | | --------------------------------------------------------- | -------------------- | | `placeOrder`, `sellToAMM`, `cancelOrder` | `nonReentrant` + CEI | | `redeemWinnings`, `claimCancelRefund`, `claimCreatorFees` | `nonReentrant` + CEI | | `disputeMarket`, `settleDispute` | `nonReentrant` + CEI | | `resolveMarket`, `cancelMarket`, `slashMarket` | `nonReentrant` + CEI | | `reclaimCancelledOrder` | `nonReentrant` + CEI | | All state-mutating admin functions | `nonReentrant` + CEI | **Consensus: 0 reentrancy vulnerabilities in active paths.** *** ## Economic Analysis — LMSR Solvency **Verdict: SOLVENT — proven by construction.** * `poolBalance + subsidyDeposited = C(q) ≥ max(q[i]) = q_winner` at all times * 1 winning share redeems for exactly 1 USDm — no pro-rata rounding * CLOB fills use escrowed USDm (BUY) or escrowed shares (SELL) — AMM pool unaffected by CLOB matching * Cancel refund pool: `poolBalance + subsidyDeposited` — subsidy recoverable by shareholders **No economic attack vector identified by any of the 7 engines.** *** ## Architecture Overview EventlyMarkets combines three trading layers: | Layer | Role | | --------------------- | ----------------------------------------------------------------------- | | LMSR AMM (b=200 USDm) | Permanent market maker; baseline liquidity; market maker of last resort | | CLOB Bids | Resting buy limit orders matched against incoming SELL orders | | CLOB Asks | Resting sell limit orders matched against incoming BUY budget | Price-time priority. Max 200 orders per (market, option, side). Max 10 active orders per user per market. *** *This document consolidates AI pre-audit findings. It does not replace a professional security audit.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.evently.market/security/pre-audit-consolidated.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.