Skip to content

Soroban contract lib.rs does not enforce a maximum number of outcomes per market #687

@hman38705

Description

@hman38705

Labels: contracts, security
Priority: High

Description

contracts/predict-iq/src/lib.rs allows market creation with multiple outcomes. Without a maximum outcome count, a malicious actor could create a market with thousands of outcomes, causing excessive gas consumption for all subsequent operations on that market.

Acceptance Criteria

  • Maximum outcome count enforced (e.g., 10) in market creation
  • Exceeding the limit returns a descriptive contract error
  • Limit value defined as a named constant, not a magic number

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave program

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions