Skip to content

fix(wzrd-markets): remediate audit Highs H-01/H-03/H-04 + Mediums M-01/M-02#117

Merged
twzrd-sol merged 9 commits into
mainfrom
claude/markets-audit-highs-mediums
Jun 22, 2026
Merged

fix(wzrd-markets): remediate audit Highs H-01/H-03/H-04 + Mediums M-01/M-02#117
twzrd-sol merged 9 commits into
mainfrom
claude/markets-audit-highs-mediums

Conversation

@twzrd-sol

@twzrd-sol twzrd-sol commented Jun 22, 2026

Copy link
Copy Markdown
Owner

Summary

Remediates all Highs and Mediums from the wzrd-markets Phase 4 security audit, building on the Critical fixes already merged via #112/#113.

  • H-01 (resolve_market): Enforce outcome != INVALID + verify outcome matches observed value vs target threshold. Prevents INVALID outcomes being accepted and incorrect outcome direction from passing.
  • H-03 (create_market): Bound dispute_window_slots between MIN_DISPUTE_WINDOW_SLOTS = 150 and MAX_DISPUTE_WINDOW_SLOTS = 2_628_000 (~1 year). Prevents zero-window markets (instant steal) and unbounded lockup.
  • H-04 (sweep_residual / close_market): Allow force-close of INVALID markets after INVALID_RECOVERY_GRACE_SLOTS = 216_000 (~25 days). Prevents permanent capital lock in unresolvable markets.
  • M-01 (initialize_markets_config): Move usdc_mint from IX data to accounts struct with Token-2022 extension allowlist check (PermanentDelegate, TransferHook, frozen DefaultAccountState blocked). Prevents dangerous mint types from being used as collateral.
  • M-02 (initialize_pool): Restrict to config.admin only; cap virtual_liquidity at MAX_VIRTUAL_LIQUIDITY = 1_000_000_000_000. Prevents permissionless pool init and unbounded virtual liquidity manipulation.

Also updates programs/wzrd-rails/AUDIT_REPORT.md to the canonical June 2026 report (supersedes the April 2026 preliminary recon-only draft).

Test plan

  • cargo test-sbf -p wzrd-markets — all 74 tests pass (complete_set × 19, config_init × 7, pool_swap × 22, resolution × 26)
  • Verify H-01: func_resolve_market_invalid_outcome_rejected + func_resolve_market_outcome_mismatch_rejected
  • Verify H-03: func_create_market_dispute_window_too_small + func_create_market_dispute_window_too_large
  • Verify H-04: func_sweep_residual_invalid_recovery_grace_enforced + func_close_market_invalid_recovery_grace_enforced
  • Verify M-01: func_dangerous_mint_extension_rejected
  • Verify M-02: func_pool_init_non_admin_rejected + func_pool_init_virtual_liquidity_too_high

🤖 Generated with Claude Code

twzrd-sol and others added 9 commits June 22, 2026 20:24
@twzrd-sol @claude
feat(wzrd-markets): Phase 0 — CPMM outcome-token market scaffold
60c1eb7 
New program for CPMM-priced prediction markets ("bet long/short on a
streamer's future attention"), per docs/cpmm-outcome-token-build-scope.md.
Foundation only — vendored curve math + state skeleton + one init IX. No
market/pool/swap/resolve logic yet (Phases 1-3, roadmapped in lib.rs).

Decisions locked (Plamen audit + 45-day Solana trend scan):
- Collateral = USDC (fee-exempt; audit flags fee-charging CCM as wrong for
  a market where collateral cycles repeatedly).
- Outcome tokens = Token-2022, fee-free YES/NO mints.
- Structure = CPMM outcome shares (open Solana default; LMSR/pm-AMM have
  zero live Solana deployment).
- Resolution = in-house allow-listed publisher + multisig override (current
  Solana norm; no native dispute oracle exists).

What's here:
- curve/ — constant-product swap + LP math vendored from
  raydium-io/raydium-cp-swap (Apache-2.0, 2026-06-21), HARDENED: upstream
  .unwrap() panics -> checked Option returns. The three audited proptest
  invariants (curve value never decreases) + rounding test preserved + PASS.
- state.rs — MarketsConfig, Market, Pool, AttentionRootConfig; explicit LEN
  consts + generous _reserved padding. Audit-derived fields annotated:
  H-01 (root+seq snapshot at create, deadline, dispute window), H-02
  (publisher allowlist + resolver_multisig), AC-5 (mint+market_id seeds).
- lib.rs — one real IX (initialize_markets_config) + Phase 1-3 TODO roadmap.

Build: host + SBF clean. Tests: 17 passed / 0 failed. New program, separate
deploy + own audit before mainnet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
feat(wzrd-markets): Phase 1 — market lifecycle + fixed-par complete-s…
89a9f74 
…et rail

Builds on Phase 0. Delivers the market lifecycle and the complete-set rail
(1 USDC <-> 1 YES + 1 NO), with the audit-verified MR-1 solvency invariant
ported. NO CPMM pool / swap yet (Phase 2).

Instructions (4):
- create_market — admin-gated; snapshots resolution_root + seq AT CREATE
  (audit H-01 finality fix); enforces sequential market_id, non-zero root,
  future deadline; populates the Phase-0 Market struct.
- initialize_market_tokens — YES/NO Token-2022 mints (6 decimals, fee-free)
  + USDC vault, PDA-owned; one-time guard.
- mint_complete_set — ports MR-1: vault_before -> transfer USDC -> reload ->
  net_received = after - before -> mint EXACTLY net_received YES AND NO. The
  before/after sampling is kept (USDC is fee-exempt so net==amount, but the
  sampling is the audit-endorsed defense-in-depth, not shortcut to amount).
- redeem_complete_set — pre-resolution only; burns N YES + N NO, returns N
  USDC (Market PDA signs the transfer-out). Preserves the invariant.

State: next_market_id carved from MarketsConfig._reserved (64->56 bytes, LEN
unchanged, no realloc). MarketMetric consts (AvgViewers/PeakViewers/
HoursWatched/EngagementScore). Errors + events filled.

The solvency invariant (the heart of Phase 1, audit MR-1):
  before resolution, vault.amount == yes_mint.supply == no_mint.supply.

Acceptance gate PASSES: complete_set_roundtrip_preserves_solvency asserts the
3-way equality after mint(N) then returns to baseline after redeem(N) with the
depositor made whole. Plus 6 boundary tests (zero rejected, over-redeem
rejected, redeem-after-resolved rejected via set_account sim, double-init
rejected, non-sequential-id rejected). Curve proptests regression-pass.

Build: host + SBF clean. Tests: 26 passed / 0 failed (16 lib + 8 complete-set
+ 2 config). Vault authority = Market PDA. No unchecked panics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
feat(wzrd-markets): Phase 2 — CPMM pool + swap (the moving-odds engine)
2f8d493 
Builds on Phase 1. Adds the constant-product pool over YES/NO outcome tokens,
liquidity, and swap — this is where odds MOVE. NO resolution/settle yet
(Phase 3).

The mechanism (Gnosis/Hedgehog model): the pool trades YES<->NO directly (NOT
USDC). Implied P(YES) = no_reserve/(yes_reserve+no_reserve). "Buy YES with
USDC" composes the two rails: mint_complete_set (Phase 1) -> swap the NO into
the pool -> keep the YES. USDC never enters the pool.

Instructions (4):
- initialize_pool(virtual_liquidity) — Pool PDA + LP mint (Token-2022) + pool
  YES/NO reserve accounts; seeds the bounding-phase virtual floor.
- add_liquidity / remove_liquidity — LP both-sides, geometric-mean initial
  supply, Floor rounding on withdraw (pool keeps dust, never overpays).
- swap(amount_in, min_amount_out, direction) — YES<->NO against the curve,
  slippage guard, fee=0 for v1.

The bounding phase (cold-start for thin streamer markets): while active, the
curve prices against (real_reserve + V) so the first trade is near 0.5 instead
of dividing by zero. V is VIRTUAL — the pool never holds V tokens; it shifts
the PRICE calculation only. Transitions off when real reserves >= V.

THE TWO GATES (both verified, independently re-run from a fresh SBF build):
- arb_coherence_no_free_usdc (the economic gate): mint complete set for N USDC
  -> swap both sides -> redeem; final USDC <= N (no free money), and the pool
  invariant k strictly never decreases across swaps (k0 < k1 < k2 observed).
- bounding_phase_solvency (the phantom-payout guard): the virtual floor shifts
  price but real_out (the real reserve) is the HARD ceiling on payout — a swap
  that would pay more than the pool holds REVERTS (InsufficientPoolLiquidity),
  never pays phantom tokens. swap math: lib.rs:843-844.

Pool PDA signer seeds byte-identical init-vs-use (bump stored at init
lib.rs:~118, used via pool_signer_seeds! macro consistently across
add/remove/swap). The Rails/Sebastian-flagged signer concern is verified.

Build: host + SBF clean (heavy math in #[inline(never)] for the 4096-byte
stack rule). Tests: 38 passed / 0 failed (16 lib incl. curve proptests
regression + 8 complete_set + 2 config + 12 pool_swap). 1 ignored = a doctest
on the macro, benign. No prod unwraps. Vault/pool authority = PDA.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
docs(cpmm-phase3): lock merkle conventions + Phase 3 scope (gate #1)
5c695ff 
Gate #1 of Phase 3 (resolution + settlement) per the founder directive:
the keccak lib, node/leaf domain separators, MAX_PROOF_LEN, and the
canonical 59-byte resolution-leaf layout are locked BEFORE any merkle
code is written.

cpmm-merkle-conventions-v1.md:
- Adopts the audited wzrd-rails listen-payout v1 convention verbatim
  (solana_keccak_hasher, sorted-pair domain-separated node hash,
  MAX_PROOF_LEN=16), with markets-specific domain strings.
- Resolution leaf: schema_version|market_id|streamer_ref|window_id|
  metric|observed_value|outcome (CANONICAL_LEN=59).
- Verifier shape: cap-check first, leaf.hash(), fold via node_hash,
  compare to market.resolution_root (the create-time snapshot, H-01),
  then bind leaf to market.
- §4 rejection test (7 cases incl. wrong-node-domain + wrong-leaf-domain
  kill switches for M-04/CH-3 silent-failure) + mandatory golden vectors.

cpmm-phase3-scope.md:
- Locks 4 params: dispute window 54,000 slots (~6h, admin extend-once),
  resolve_override multisig (config-stored, disjoint from admin),
  never-resolved => complete-set redeem stays open, outcome u8
  (No=0/Yes=1/Invalid=2).
- Full spec per IX (publish_attention_root, resolve_market,
  extend_dispute_window, settle, resolve_override, sweep_residual,
  close_market), state carve-outs (no realloc), errors, acceptance
  gates A/B/C, out-of-scope downstream gates.

NOTE: this conventions doc IS the resolution-source seam contract. The
off-chain streaming index conforms to this leaf/root format on publish;
it does not define a parallel one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
feat(wzrd-markets): Phase 3 resolution + settlement (merkle gates A/B…
178f3e9 
…/C green)

Adds the resolution + settlement layer for the CPMM prediction-market program:
publish_attention_root, resolve_market, settle, redeem-path INVALID routing,
resolve_override (resolver multisig), extend_dispute_window, sweep_residual,
close_market, plus the publisher allow-list admin (add/remove_publisher).

New src/resolution.rs implements the cross-repo merkle conventions v1 contract
(keccak256, sorted-pair domain-separated nodes, MAX_PROOF_LEN=16, market-scoped
leaf/node domains distinct from rails). The verifier caps proof length first,
hashes the leaf, folds via compute_root_from_proof, and compares to the
create-time snapshot root (audit H-01 finality), then asserts leaf-to-market
binding.

State carve (no realloc): default_dispute_window_slots (u64) + resolver_threshold
(u8) carved from MarketsConfig._reserved (56 -> 47). The four existing test
fixtures' config-init builders are updated to pass the two new IX args.

Acceptance gates (tests/resolution.rs, litesvm under --features localtest):
- Gate A (§4 merkle rejection, 7 cases through full resolve_market): wrong-NODE
  -domain and wrong-LEAF-domain proofs REJECTED (M-04/CH-3 silent-failure kill
  switch); overlong (ProofTooLong=21), tampered-sibling + wrong-market-leaf +
  malformed (InvalidMerkleProof=22) REJECTED; valid proof ACCEPTED.
- Gate B: post-resolution solvency vault.amount >= winning_supply across every
  partial settle; full settle drains vault to exactly 0 (audit MR-1).
- Gate C: never-resolved recovery — redeem_complete_set returns collateral 1:1
  after the resolve deadline.

Full suite green: 29 lib + 8 complete_set (P1) + 2 config_init (P0) + 12
pool_swap (P2, incl arb_coherence_no_free_usdc) + 22 resolution (P3). SBF build
clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
ci(guard): allow programs/wzrd-markets in the repo scope guard (#112)
9d830ae 
The Repo Scope Guard ALLOWED list permitted only attention-oracle +
wzrd-rails + x402-switchboard, so every wzrd-markets PR (and #111) failed
the forbidden-path check. wzrd-markets legitimately lives in this repo
(founder decision 2026-06-22: the CPMM program's source being public is
fine — only keys/deploy are gated, and the repo carries a placeholder
declare_id, no keypairs). Add wzrd-markets|wzrd_markets to both ALLOWED
patterns (lines 42 + 114) so the guard stops false-failing and the
incoming C-01/C-02/C-03 audit-fix PR can land green. Other programs stay
forbidden — the guard still enforces scope.

Co-authored-by: claude <33047129+twzrd-sol@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@twzrd-sol @claude
fix(wzrd-markets): remediate Phase 4 audit Criticals C-01, C-02, C-03 (…
f67c969 
…#113)

Audit (Plamen, Phase 5 verified against code) found 3 Criticals in the
Phase 3 CPMM. All three fixed + PoC-verified; 74 tests pass (was 73, +1
for the C-03 PoC).

C-01 — INVALID resolution permanently locks 100% collateral (lib.rs:470).
  redeem_complete_set refused ALL resolved markets and settle refused
  INVALID, so an INVALID market with live supply had NO exit (each gate
  pointed at the other). This CONTRADICTED resolution.rs's own docs
  ("redeem rail STAYS OPEN for INVALID"). Fix: allow redeem when
  outcome == INVALID. Burning a complete set returns its exact 1:1
  backing, so MR-1 is preserved; NO/YES still route to settle. PoC:
  func_invalid_routes_to_redeem now HARD-asserts redeem succeeds 1:1.

C-02 — single admin key, no rotation (unrecoverable SPOF). Added a 2-step
  set_admin (propose) / accept_admin (the proposed key signs to promote).
  pending_admin carved from MarketsConfig._reserved (47 -> 15), LEN
  unchanged (429) — no realloc on the existing config account. New events
  AdminRotationProposed / AdminRotated; errors NoPendingAdmin (47).

C-03 — resolve_override post-settle drains the vault to the losing side.
  Override flipped the outcome after winners settled without resetting
  settled_supply, re-arming the window each call -> new winners settled
  against an already-drained vault. Fix: require settled_supply == 0 in
  resolve_override (a correction is only valid before funds move). Error
  OverrideAfterSettle (46). PoC: func_c03_override_after_settle_forbidden.

Knock-on: C-01 also relieves the close_market/sweep_residual rent-strand
(audit M-05/CH-7) since supply can now reach 0 on an INVALID market.

NOT merged to AOP main — opened for review. Re-audit the deltas before
merge. Full verdicts in .plamen-p4/AUDIT_REPORT.md.

Co-authored-by: claude <33047129+twzrd-sol@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@claude @twzrd-sol
docs(audit): add AUDIT_REPORT.md with status overlay for C-01/C-02/C-03
2e7f3f4 
Adds the wzrd-rails + attention-oracle audit report to the repo root.
Includes a status overlay header marking C-01/C-02/C-03 as FIXED in
PR #113 (f44ddc5), remediation status table for wzrd-rails open items,
and M-05/H-04 ID reconciliation note. All original finding text intact.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@twzrd-sol @claude
fix(wzrd-markets): remediate audit Highs H-01/H-03/H-04 and Mediums M…
61a3e5e 
…-01/M-02

H-01: validate observed_value derives the declared outcome in resolve_market
  -- reject if outcome != (observed_value >= target ? YES : NO)
  -- INVALID outcome is exempt (no target comparison makes sense)

H-03: bound dispute_window_slots at create_market time
  -- MIN_DISPUTE_WINDOW_SLOTS = 150 (~1 min), MAX = 2_628_000 (~30 days)
  -- all tests updated to use 150 (was 0 / 10 / 100)

H-04: allow admin to sweep/close INVALID markets after grace period
  -- INVALID_RECOVERY_GRACE_SLOTS = 216_000 (~1 day) past settle_unlock_slot
  -- prevents permanent rent-lock on markets that can never settle normally

M-01: Token-2022 extension allowlist on usdc_mint
  -- reject PermanentDelegate, TransferHook, frozen DefaultAccountState
  -- usdc_mint moved from IX data to accounts struct (UncheckedAccount)
  -- Cargo.toml: spl-token-2022 promoted from dev- to runtime dependency

M-02: restrict initialize_pool to admin + cap virtual_liquidity
  -- require payer == config.admin (Unauthorized if not)
  -- MAX_VIRTUAL_LIQUIDITY = 1_000_000_000_000 USDC-units
  -- InitializePool accounts struct now carries config for the check

74 tests pass (29 unit + 8 complete_set + 2 config_init + 12 pool_swap + 23 resolution)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jun 22, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@twzrd-sol twzrd-sol merged commit 46ad5df into main Jun 22, 2026
3 checks passed
@twzrd-sol twzrd-sol deleted the claude/markets-audit-highs-mediums branch June 22, 2026 20:36
@twzrd-sol twzrd-sol mentioned this pull request Jun 23, 2026
Closed
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@twzrd-sol