Skip to content

[CRITICAL] set_config can re-point market to malicious contracts — total fund theft #173

Closed
#193
Closed
[CRITICAL] set_config can re-point market to malicious contracts — total fund theft#173
#193
Assignees
samjay8
Labels
GrantFox OSSIssue tracked in GrantFox OSSThird CampaignCampaign: Third CampaigncriticalCritical severity - funds at riskprediction-marketPrediction market contractsecuritySecurity vulnerability

Description

@grantfox-oss
grantfox-oss
bot
opened on Aug 23, 2026

Summary

prediction_market/src/lib.rs set_config (lines ~375-420) allows the governor to replace the token, referral, leaderboard, and XLM Sac contract addresses without any validation. There is no allowlist check, no code-hash pinning, and no event emission for config changes.

Impact

  • A compromised or malicious governor can redirect all place_bet XLM deposits to a malicious token contract that absorbs funds and never credits outcomes.
  • A malicious referral registry can intercept 100% of referral fees.
  • A malicious leaderboard can inflate rewards to arbitrary addresses.
  • No off-chain monitoring is possible — no event is emitted when the config changes.

Fix

  • Pin WASM hashes for all dependency contracts and verify on set_config.
  • Require a timelock (7+ days) between config request and approval.
  • Emit a ConfigChanged event with old/new addresses.
  • Maintain an allowlist of approved dependency deployments.

Activity

  1. grantfox-oss
    added
    criticalCritical severity - funds at risk
    securitySecurity vulnerability
    prediction-marketPrediction market contract
    GrantFox OSSIssue tracked in GrantFox OSS
    Third CampaignCampaign: Third Campaign
    on Aug 23, 2026

  2. samjay8 commented on Aug 23, 2026

    @samjay8
    samjay8
    on Aug 23, 2026 – with GrantFox OSS
    Contributor

    Hi team,

    I'd like to work on resolving this issue. Here is my proposed plan of approach to secure set_config against arbitrary contract replacement risks:

    Plan of Approach

    1. WASM Hash Pinning & Allowlist Validation:

      • Update set_config in prediction_market/src/lib.rs (~lines 375-420) to validate new target contract addresses against an allowlist of approved WASM executable code-hashes.
      • Verify that any updated target contract address matches expected WASM bytecode before allowing state updates.

    2. Implement Timelocked Configuration Updates:

      • Introduce a two-step timelock mechanism (request_config_change and execute_config_change) with a mandatory delay window (e.g., 7 days).
      • Ensure pending configuration changes are stored temporarily and cannot take effect until the timelock expires, giving off-chain monitors time to react.

    3. Emit ConfigChanged Event:

      • Define and emit a structured ConfigChanged event containing old/new contract addresses, parameter identifiers, and execution timestamps to enable off-chain indexing and security alerts.

    4. Testing & Security Assertions:

      • Write unit tests verifying that unauthorized WASM code-hashes are immediately rejected during set_config.
      • Add integration tests validating timelock delay enforcement and confirming ConfigChanged event emissions upon execution.

    I can implement these security enhancements and test cases promptly.

  3. grantfox-oss
    assigned
    samjay8
    on Aug 23, 2026

  4. grantfox-oss commented on Aug 23, 2026

    @grantfox-oss
    grantfox-ossbot
    on Aug 23, 2026 – with GrantFox OSS
    Author

    🦊 GrantFox — @samjay8 has been assigned to this issue as part of the Third Campaign campaign!

    Next steps:

    1. Open a Pull Request referencing this issue (e.g., Closes #173)
    2. Your PR will be reviewed by the SPulse-Org maintainers

    Good luck! Track your progress on GrantFox.

  5. freebuff-web
    added a commit that references this issue on Aug 30, 2026

    fix: add ConfigChanged event and increase timelock to 7 days (issue S…

    65a1d43
  6. Muyideen-js
    added a commit that references this issue on Aug 30, 2026

    Merge pull request #193 from samjay8/fix/issue-173

    e7ec1c8
  7. Muyideen-js
    closed this as completedin #193on Aug 30, 2026

  8. grantfox-oss commented on Aug 30, 2026

    @grantfox-oss
    grantfox-ossbot
    on Aug 30, 2026 – with GrantFox OSS
    Author

    🎉 This issue has been marked as completed on GrantFox!

    @samjay8's PR #193 was approved and merged by @Muyideen-js.

    🏆 @samjay8: You earned 40 FoxPoints for this contribution! Your current tier: Builder (2,140 total points). Track your full progress on GrantFox.

    👏 Great work, @samjay8! Keep contributing to SPulse-Org.

  9. Dayz-tech-co
    added a commit that references this issue on Aug 31, 2026

    Merge branch 'main' into fix/issue-24-leaderboard-merge-corruption

    7e22445
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSThird CampaignCampaign: Third CampaigncriticalCritical severity - funds at riskprediction-marketPrediction market contractsecuritySecurity vulnerability

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions