Predictr · Security
The controls we checked, the risks that remain, and the evidence behind each assessment.
The review covers token launch and swap integration, prediction contracts and resolvers, wallet transaction paths, API input handling, image uploads, metadata, administrative access, indexing, oracle scanning and deployment configuration. Evidence includes source inspection, Foundry tests, TypeScript and production builds, dependency advisory checks, and local HTTP checks.
Third-party contract internals, formal verification, a full penetration test and production infrastructure are outside the completed assurance. The source manifest identifies the files in this snapshot; a listed file is not a claim of exhaustive path coverage.
Download source snapshot and verification record ↓The local mainnet-fork test launches through the real Pons integration, creates a USDG market, reaches graduation, resolves the market and checks redemption. The test uses forked chain state and does not send mainnet transactions.
Evidence and limits: PonsForkTest: one integration test passed with RH_FORK enabled. This does not verify a production deployment or the worker/indexer end-to-end.
The tested trading and settlement sequences keep share backing separate from protocol fees, creator fees, LP fees and dispute bonds. Fee withdrawals pay their designated recipients.
Evidence and limits: 37 prediction contract tests, including a 2,000-run accounting fuzz test and treasury-only buy/sell fee withdrawal.
Market resolution is restricted to its resolver and disputed outcomes to the active arbitrator. Reentrant trading is rejected in the malicious-receiver test. Factory-created clones are initialized within the creation transaction.
Evidence and limits: Contract source review; unauthorized-resolution, reentrancy and market-creation tests.
Paused markets reject new trading and the factory rejects new market funding. Merge, eligible liquidity withdrawals, disputes, finalization and redemption remain available under their normal rules.
Evidence and limits: Pause/exits and paused-factory funding regression tests.
Tests cover dispute bonds, arbitration timeout, missing proposals, graduation and price proofs. Repeated identical touch proofs cannot extend a dispute window. The unsupported liquidity-history metric cannot accept new deposits. Signed metric reports reject contradictory threshold answers, future data blocks, missing evidence hashes and YES observations after the measurement window.
Evidence and limits: Prediction contract lifecycle, oracle-proof, unsupported-metric and signed-report consistency tests.
Prediction trading fees are capped at 3%. Deployment preflight requires prediction fees to use the launcher's treasury wallet and allocates the entire prediction fee to it. Existing market fee terms are fixed; the factory owner can change the treasury destination and future-market defaults.
Evidence and limits: Fee-cap and treasury payout tests; deployment script source review. The live factory feeConfig() returns 100 / 0 / 0 / 10000 and treasury() returns the launcher fee recipient (D-01).
All seven contracts are deployed on Robinhood Chain (4663) and wired as reviewed: the launcher points at the live Pons V2 factory with an immutable 2.00% creator tax and treasury recipient; the router points at the Uniswap V4 PoolManager; the factory points at the launcher and uses a 1.00% prediction fee paid 100% to the treasury; USDG is the only collateral (25 USDG minimum liquidity, 0.01 USDG minimum trade, 50 USDG dispute bond); all three resolvers are approved with the correct market class and point back at the factory; the metric reporter is an authorised signer. Every deployment transaction succeeded.
Evidence and limits: Onchain reads on 2026-09-21 against the addresses in contracts/deployments/robinhood-4663*.json and the broadcast receipts (L2 blocks 68,511,191 to 68,513,039). Launcher quoteFees(): 300 bps total trade fee, including the 200 bps creator tax.
The fees chapter returned a server error in production because its chain client depended on the full server environment and was created outside its error handling. Chain reads now need only the RPC URL, every fee source is read independently, and a failed read shows a fallback instead of an error page.
Evidence and limits: Production /docs/fees returned HTTP 500 before the fix and HTTP 200 after it was deployed; /api/health now reports the RPC as reachable in production.
Wallet writes use network selection, simulation and receipt confirmation. Token and market trades submit minimum outputs. Market liquidity additions submit a nonzero pool-share minimum and disable submission without a usable quote.
Evidence and limits: Transaction and trade-panel source review; contract slippage regression; TypeScript checks.
Upload and metadata bodies have byte and read-time limits, including chunked requests. Shared hourly and daily submission budgets apply before per-IP counters and body parsing; counters saturate instead of overflowing. Public listing APIs reject malformed or out-of-range pagination and token-trade APIs reject invalid date cursors.
Evidence and limits: Request-limit unit tests, local HTTP rejection checks and a Postgres concurrency/rotating-IP/overflow/window-reset regression.
Uploads accept only PNG, JPEG, WebP and GIF. Detected dimensions, animation frame count and total pixels are bounded; SVG and unparseable image headers are rejected. Images are served with nosniff and a restrictive image response policy.
Evidence and limits: Raster-format, truncated-input, JPEG/WebP dimension and valid-image regression tests; upload and image-response source review.
Template text is generated on the server. Registration requires the complete regenerated spec to match the submitted spec, including manual dispute-window terms. Discovery requires both metadata and spec hashes to match the indexed contract event.
Evidence and limits: Metadata and discovery source review; malformed-spec and mismatched-manual-spec HTTP checks.
Administrative pages and actions check credentials, with the dashboard disabled when credentials are absent. Administrative writes require the configured origin. Response policies deny framing and MIME sniffing; production HTTPS termination remains a deployment check.
Evidence and limits: Proxy and handler source review; local unauthorized-admin, cross-origin and security-header checks.
The tested scanner includes rounds exactly at the window start and searches across feed phases. Transport errors, exhausted scan limits, missing current-phase rounds and missing intermediate phases stop the scan rather than providing evidence for a NO proposal.
Evidence and limits: Oracle-history regression tests; keeper and resolver source review.
The reviewed web and worker compile, typecheck and pass the recorded regression suite. npm reports no known advisories for the reviewed application dependency lockfile. Advisory scanning does not establish that dependencies are free of vulnerabilities.
Evidence and limits: Production web/worker builds, workspace typecheck, 14 request/image/oracle regressions and one Postgres rate-limit regression, npm audit. Dependency results are a dated snapshot.
Discovery and portfolio summaries can lag chain activity or temporarily reflect stale data during reorg recovery. Trading reads contracts directly, but users must still review wallet prompts. This review inspects the indexer and rollback code without certifying production recovery behavior.
Evidence and limits: Indexer checkpoints, event-derived rebuilds and live trade-panel reads; production recovery rehearsal remains pending.
Pons can change fee policy and redirect token creator-fee recipients under its own controls. Predictr's launcher rejects mismatched curve/hook fee models, which can stop new launches. Treasury revenue and launch availability therefore depend on Pons policy.
Evidence and limits: Launcher quote checks and Pons-event monitoring source review.
The deployment enabled no Chainlink feeds on the PriceOracleResolver, so new price markets revert with FeedNotEnabled. Token markets, manual markets, trading and settlement are unaffected and no funds are at risk. Cause: blank PREDICTION_CRYPTO_FEEDS / PREDICTION_EQUITY_FEEDS values in the deployment environment were read as empty lists instead of defaults. The deploy script now treats blank values as unset and refuses to deploy with no feeds. Mitigated on the site: the market form now checks each feed onchain and blocks price markets whose feed is disabled, with an explanation, instead of letting the wallet transaction revert. Open until the factory owner calls setFeed for BTC/USD, ETH/USD and RHNVDA/USD; this needs the owner key and cannot be done in code.
Evidence and limits: PriceOracleResolver.feeds() still returned disabled for all three proxies when rechecked on 2026-09-21; each setFeed call simulates successfully from the owner. The Contracts documentation chapter shows the live status.
Funded participants can influence volume, holder and trader targets. Thin pools expose providers to informed trading and adverse price movement. Token creators and LPs receive no prediction trading fees under the deployment defaults. A pool-share minimum does not freeze the mix of YES and NO received when adding liquidity.
Evidence and limits: Metric definitions, pool mechanics and published market rules. This is an economic design risk, not a promise of fee income or returns.
One externally owned wallet, which is also the deployer, is the owner of the launcher and the factory (and therefore governs all three resolvers) and is the guardian of both. Compromise of that key allows pausing launches and trading, redirecting treasury revenue including fees already accrued in markets, changing fees and windows for future markets within the contract caps, approving new resolvers, and installing a new arbitrator after the 2-day timelock. Because the guardian is the same key, the guardian cannot act as an independent check by cancelling a hostile arbitrator or guardian change. The arbitrator is also a single externally owned wallet. No role can move the USDG that backs shares. Fix, which needs the owner key and cannot be done in code: create a multisig; call transferOwnership(multisig) on the launcher and the factory and acceptOwnership() from the multisig; call setGuardian(newGuardian) on the launcher and proposeGuardian(newGuardian) on the factory (executable after 3 days); proposeArbitrator(multisigArbitrator) on the factory (executable after 2 days).
Evidence and limits: Rechecked on 2026-09-21: owner() and guardian() on both contracts return the same address, which has no contract code; arbitrator() returns a different address with no contract code; no ownership, guardian or arbitrator change is pending.
The production web service cannot use its database, so market listings (the Markets tab), market registration, rate limiting, the worker heartbeat and the admin dashboard fail. The chain connection now works. The health endpoint now reports which step fails as dbFailedAt: config (DATABASE_URL missing), connect (database unreachable, wrong credentials, or TLS required but DATABASE_SSL is not set to require), or schema (connected but migrations not applied; run node packages/db/dist/migrate.js). Fixing it needs access to the Railway project.
Evidence and limits: On 2026-09-21 https://predictr.markets/api/health returned HTTP 503 with db false, rpc true and about 124 ms latency, and /api/markets returned HTTP 500. The deployed JavaScript bundle contains all seven contract addresses.
Blockscout verification status could not be confirmed from the review environment, whose requests were blocked by a bot challenge. Users should be able to read verified source for every Predictr contract.
Evidence and limits: Blockscout API requests returned a challenge page. Verification commands are listed in DEPLOYMENT_REPORT.md section J.
No independent auditor's report or certification is supplied for this source snapshot. This page is an internal development review and is not a substitute for an independent assessment.
Evidence and limits: No independent report verified.
Deployed bytecode, addresses and wiring are verified (D-01). Still open: price feeds (D-02), separation of owner, guardian and arbitrator keys (D-03), source verification (D-04), the production server environment (O-02), backups and active monitoring.
Evidence and limits: Onchain checks on 2026-09-21; production health endpoint; production backups and monitoring were not inspected.
Real wallet interactions, responsive visual checks and the deployed launch-to-indexing-to-settlement flow have not been exercised for this release. HTTP rendering checks do not verify wallet behavior or visual layout.
Evidence and limits: Local page/API responses are checked; connected-browser and production transaction evidence is not available.
Read the risk disclosures and each market's rules before using Predictr. The review is a dated snapshot and must be repeated when relevant code or deployment settings change.
