Foresight
Catching a collateral backing break before public launch. 6 findings across the AMM, referral, and redemption flows, every high and medium fixed and verified.
About the client
Foresight is a prediction market built on Katana, utilizing AUSD as collateral for trading conditional tokens representing different event outcomes.
The system employs an LMSR (Logarithmic Market Scoring Rule) automated market maker to provide liquidity and dynamic pricing, while the ConditionalTokens contract manages ERC1155-based outcome positions that can be minted, traded, and redeemed upon condition resolution.
"Phage Security was super helpful as a preliminary audit partner. They caught important edge cases that gave us the confidence to launch publicly."
"Highly recommended!"
EASON CHAI, LEAD DEVELOPER AT FORESIGHTThe team on this audit
Lead Security Researcher at Sherlock. Over 100 audits performed and 500+ bugs found.
Lead Security Researcher at Sherlock. OG auditor with multiple Top3 finishes in audit contests.
A promising Security Researcher. In the space for ~1 year, and showing remarkable results.
High severity issues and fixes
AMM mint function miscalculates collateral backing
The mint path miscalculated collateral backing, leaving market prices vulnerable to manipulation by MEV bots.
Markets now ensure sufficient liquidity before they begin operating.
Any user can drain the referral contract
Referral payouts accepted arbitrary market addresses, so any user could drain the referral contract.
Market addresses are now whitelisted, preventing users from routing payouts through malicious addresses.
Unauthorized redemption in redeemPositionForUser
Users could redeem other users' positions without their consent.
Access control was implemented for redeemPositionsForUser.
Plus 1 medium and 2 low severity findings. All documented in the full report.
Why Phage Security
Foresight entrusted its security to Phage for our researchers' extensive experience in the prediction market space. We caught three high severity issues before public launch, including a collateral backing break and a drainable referral contract. Foresight shipped every fix and launched with confidence.