Repository navigation
[MEDIUM] create_market allows duration_secs = 0 and has no minimum duration — instantly-expired and griefable markets #55
Description
[MEDIUM] create_market allows duration_secs = 0 and has no minimum duration — instantly-expired and griefable markets
Summary
create_market (prediction_market/src/lib.rs, lines ~278–325) computes end_time = env.ledger().timestamp() + duration_secs with no validation that duration_secs > 0:
let end_time = env.ledger().timestamp() + duration_secs;If duration_secs = 0, the market is instantly expired — place_bet immediately returns MarketExpired (line ~349), so no one can ever bet. The admin can create such markets freely (subject only to the hourly rate limit), and there is no minimum-duration enforcement.
Why it's unsolvable by a localized patch
- Adding a
duration_secs > 0check is trivial, but it doesn't address the deeper issue: there is no minimum meaningful duration, so an admin can create a market that expires in 1 second, front-run a bet, and resolve it — a market-manipulation vector. - The rate limit (
MAX_MARKETS_PER_HOUR) limits count, not duration, so an attacker can flood the market list with useless instantly-expired markets, degrading the UI and theget_market_count-based indexers. - There is no market-creation fee, so creating garbage markets is free (only gas).
The root problem is that market creation has no economic or temporal guardrails. A correct fix requires a minimum duration, a creation fee, and/or a maximum concurrent-market cap — a policy change, not a code fix.
Related
The same lack of guardrails affects resolve_market (issue #3) and the empty-side sweep.
Activity
Aycode01 commentedon Aug 17, 2026
I want to work on this issue because it highlights an important gap in the market creation rules: markets can currently be created without meaningful temporal or economic guardrails. While
duration_secs = 0is an obvious validation issue, the deeper concern is how extremely short-lived or spam markets could affect users, indexers, and the overall reliability of the prediction market.I’m interested in working on this because it requires thinking beyond a single validation check and considering the appropriate constraints for market creation. I would like to investigate options such as minimum market duration, creation fees, and limits on concurrent markets, and understand the trade-offs each approach introduces.
This issue would also give me an opportunity to improve the contract’s defensive design and add tests around invalid durations, very short markets, market creation limits, and interactions with betting and resolution.
Ultimately, I want to work on this issue because establishing sensible guardrails at market creation is important for preventing abuse and ensuring that markets remain useful, predictable, and reliable for users.
grantfox-oss commentedon Aug 17, 2026
🦊 GrantFox — @Aycode01 has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #55)Good luck! Track your progress on GrantFox.
feat: guard market creation with 1h min duration and 50-market open c…
grantfox-oss commentedon Aug 31, 2026
🎉 This issue has been marked as completed on GrantFox!
@Aycode01's PR #201 was approved and merged by @Muyideen-js.
🏆 @Aycode01: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,308 total points). Track your full progress on GrantFox.
👏 Great work, @Aycode01! Keep contributing to SPulse-Org.
Merge pull request SPulse-Org#201 from Aycode01/fix/issue-55-market-c…