Security Considerations

This document outlines the security considerations and protection strategies for the Predictify Hybrid prediction market smart contracts.

🎯 Overview

The Predictify Hybrid contract implements comprehensive security measures to protect user funds, ensure market integrity, and maintain system availability. This document details the security architecture, threat models, and mitigation strategies.

🔐 Core Security Principles

1. Defense in Depth

Multiple layers of security controls ensure that failure of one control doesn't compromise the system:

Input Validation: Comprehensive validation of all user inputs
Access Control: Role-based authorization for administrative functions
Oracle Authentication: Cryptographic verification of oracle data
Rate Limiting: Protection against flooding attacks
Audit Logging: Comprehensive tracking of all security-relevant events

2. Least Privilege

Users and contracts only have the minimum permissions necessary:

User Operations: Limited to betting, voting, and claiming winnings
Admin Operations: Segregated by role with specific permissions
Oracle Operations: Only authorized oracle contracts can update market outcomes

3. Fail Secure

System defaults to secure state when errors occur:

Circuit Breaker: Automatic pause on suspicious activity
Graceful Degradation: Fallback mechanisms for oracle failures
Error Handling: Secure error responses that don't leak sensitive information

🔒 Oracle Callback Authentication

Overview

The Predictify Hybrid contract implements a comprehensive oracle callback authentication system to ensure that only authorized oracle contracts can update oracle-driven state. This prevents malicious actors from manipulating market outcomes through unauthorized oracle callbacks.

Authentication Flow

1. Caller Authorization

// Only whitelisted oracle contracts can invoke callbacks
pub fn verify_caller_authorization(&self, caller: &Address) -> Result<(), Error> {
    let whitelist = OracleWhitelist::from_env(&self.env);
    
    if !whitelist.is_oracle_authorized(caller)? {
        return Err(Error::OracleCallbackUnauthorized);
    }
    Ok(())
}

2. Signature Verification

// Cryptographic verification of oracle data authenticity
pub fn verify_signature(&self, caller: &Address, callback_data: &OracleCallbackData) -> Result<(), Error> {
    let message = self.create_signature_message(callback_data);
    
    if !self.verify_ed25519_signature(caller, &message, &callback_data.signature)? {
        return Err(Error::OracleCallbackInvalidSignature);
    }
    Ok(())
}

3. Replay Protection

// Prevent replay attacks using nonce tracking
pub fn prevent_replay_attack(&self, caller: &Address, callback_data: &OracleCallbackData) -> Result<(), Error> {
    let nonce_key = StorageKey::OracleNonce(caller.clone(), callback_data.nonce);
    
    if self.env.storage().get(&nonce_key).unwrap_or(false) {
        return Err(Error::OracleCallbackReplayDetected);
    }
    
    self.env.storage().set(&nonce_key, &true);
    Ok(())
}

4. Rate Limiting

// Prevent oracle flooding attacks
pub fn enforce_rate_limiting(&self, caller: &Address) -> Result<(), Error> {
    let rate_limit_key = StorageKey::OracleRateLimit(caller.clone());
    let current_time = self.env.ledger().timestamp();
    let last_callback_time: u64 = self.env.storage().get(&rate_limit_key).unwrap_or(0);
    
    if current_time < last_callback_time + MIN_CALLBACK_INTERVAL {
        return Err(Error::OracleCallbackTimeout);
    }
    
    self.env.storage().set(&rate_limit_key, &current_time);
    Ok(())
}

Security Controls

Data Validation

Feed ID Validation: Ensures feed identifiers are non-empty and properly formatted
Price Bounds: Validates prices are within reasonable ranges (prevents extreme values)
Timestamp Freshness: Ensures data is not stale or from the future
Nonce Validation: Prevents replay attacks with unique nonces

Cryptographic Protection

Ed25519 Signatures: Industry-standard cryptographic signatures
Message Construction: Deterministic message creation for signature verification
Key Management: Secure oracle contract key management

Access Control

Oracle Whitelist: Only pre-approved oracle contracts can make callbacks
Active Status Check: Inactive oracles cannot update market outcomes
Admin Authorization: Oracle whitelist management requires admin permissions

Error Types

Error	Description	Security Impact
`OracleCallbackAuthFailed`	General authentication failure	High
`OracleCallbackUnauthorized`	Caller not in whitelist	High
`OracleCallbackInvalidSignature`	Signature verification failed	High
`OracleCallbackReplayDetected`	Replay attack detected	High
`OracleCallbackTimeout`	Rate limit exceeded	Medium

Integration Points

Market Resolution

// Oracle callbacks are integrated with market resolution
pub fn process_authenticated_callback(
    env: &Env,
    caller: &Address,
    callback_data: &OracleCallbackData,
    market_id: &Symbol,
) -> Result<(), Error> {
    // Authenticate callback
    let auth = OracleCallbackAuth::new(env);
    auth.authenticate_and_process(caller, callback_data)?;
    
    // Update market resolution
    Self::update_market_resolution(env, callback_data, market_id)?;
    Ok(())
}

Event Emission

// Comprehensive audit trail
pub fn emit_oracle_callback(
    env: &Env,
    oracle_address: &Address,
    feed_id: &String,
    price: i128,
    timestamp: u64,
) {
    env.events().publish(
        (Symbol::new(env, "oracle_callback"), oracle_address, feed_id, price, timestamp),
        (),
    );
}

🛡️ Access Control and Authorization

Role-Based Access Control (RBAC)

Admin Roles

SuperAdmin: Full system control
MarketAdmin: Market management permissions
ConfigAdmin: Configuration management
FeeAdmin: Fee management
ReadOnlyAdmin: View-only permissions

Permission Matrix

Role	Market Creation	Oracle Management	Fee Management	User Management
SuperAdmin	✅	✅	✅	✅
MarketAdmin	✅	❌	❌	❌
ConfigAdmin	❌	✅	✅	❌
FeeAdmin	❌	❌	✅	❌
ReadOnlyAdmin	❌	❌	❌	❌

Multi-Admin Approval

Critical operations require multiple admin approvals:

Oracle Whitelist Changes: Require 2+ admin approvals
Configuration Updates: Require 2+ admin approvals
Emergency Pauses: Require superadmin + 1 other admin

🔄 Input Validation and Data Integrity

Outcome Deduplication

The contract implements comprehensive outcome deduplication to prevent market manipulation:

Normalization Process

Whitespace Normalization: Trim and compress whitespace
Case Normalization: Convert to lowercase
Punctuation Removal: Remove common punctuation
Unicode Safety: Handle Unicode characters securely

Similarity Detection

Levenshtein Distance: Detect outcomes >80% similar
Semantic Groups: Identify common synonyms (yes/yeah, no/nope)
Exact Duplicates: Case-insensitive exact match detection

Validation Rules

Validation	Rule	Error Type
String Length	1-255 characters	`StringTooLong`/`StringTooShort`
Array Size	2-10 outcomes	`ArrayTooLarge`/`ArrayTooSmall`
Price Range	0 to $10M (8 decimals)	`InvalidPrice`
Timestamp	±5 minutes from current	`OracleStale`
Nonce	1 to 2^64-1	`InvalidOracleFeed`

⚡ Denial of Service Protection

Circuit Breaker System

Trigger Conditions

High Error Rate: >50% error rate over 5 minutes
Oracle Failures: Multiple oracle failures
Network Congestion: High transaction failure rate
Security Threats: Detected attack patterns

Protection Mechanisms

Rate Limiting: Per-user and per-operation limits
Gas Optimization: Early validation to prevent gas exhaustion
Batch Limits: Maximum batch sizes for operations
Timeout Protection: Maximum execution time limits

Rate Limiting Configuration

Operation	Rate Limit	Window
Oracle Callbacks	1 per 10 seconds	Per oracle
Market Creation	5 per hour	Per user
Betting	100 per hour	Per user
Voting	50 per hour	Per user

🔍 Audit and Monitoring

Event Logging

Security Events

Oracle Callbacks: All authenticated oracle callbacks
Authorization Failures: Failed access attempts
Admin Actions: All administrative operations
Circuit Breaker: System protection activations

Event Structure

pub struct SecurityEvent {
    pub timestamp: u64,
    pub actor: Address,
    pub action: SecurityAction,
    pub target: Option<Address>,
    pub metadata: String,
    pub result: SecurityResult,
}

Monitoring Metrics

Key Indicators

Failed Authentication Rate: Monitor unauthorized access attempts
Oracle Consensus Health: Track oracle agreement rates
Circuit Breaker Triggers: Track protection system activations
Error Rates: Monitor system health and performance

Alert Thresholds

Authentication Failures: >10 per hour
Oracle Disagreements: >3 consecutive disagreements
Error Rate: >5% over 1 hour
Gas Usage: Abnormal gas consumption patterns

🚨 Incident Response

Incident Classification

Critical

Fund loss or theft
Admin key compromise
Oracle manipulation
System-wide failure

High

Market manipulation
DoS attacks
Data corruption
Security breach

Medium

Unauthorized access attempts
Validation failures
Performance degradation
Configuration errors

Low

Suspicious activity
Performance issues
Minor errors | Recovery Strategy | Error Types | |------------------|-------------| | RetryWithDelay | OracleUnavailable, InvalidInput | | AlternativeMethod | MarketNotFound, ConfigNotFound | | Skip | AlreadyVoted, AlreadyBet, AlreadyClaimed | | Abort | Unauthorized, MarketClosed, MarketResolved | | ManualIntervention | AdminNotSet, DisputeFeeFailed | | NoRecovery | InvalidState, InvalidOracleConfig, OracleConfidenceTooWide |

Response Procedures

Detection

Automated Monitoring: Continuous system monitoring
Alert Systems: Real-time alerting for critical events
Log Analysis: Regular review of security logs
Health Checks: Periodic system health verification

Assessment

Impact Analysis: Determine scope and impact
Threat Classification: Categorize threat level
Root Cause Analysis: Identify underlying cause
Risk Assessment: Evaluate ongoing risks

Containment

Circuit Breaker: Activate protection systems
Access Revocation: Revoke compromised access
System Isolation: Isolate affected components
Data Preservation: Preserve evidence for analysis

Recovery

System Restoration: Restore normal operations
Data Recovery: Recover from backups if needed
Security Updates: Apply security patches
Access Restoration: Restore legitimate access

Post-Mortem

Incident Report: Document incident details
Lessons Learned: Identify improvement opportunities
Security Updates: Implement security improvements
Training: Update team knowledge and procedures

🔮 Future Security Enhancements

Planned Improvements

Advanced Cryptography

Zero-Knowledge Proofs: Enhanced privacy for sensitive operations
Multi-Signature Wallets: Enhanced admin security
Threshold Signatures: Distributed key management

Advanced Monitoring

Machine Learning Detection: AI-powered anomaly detection
Behavioral Analysis: User behavior pattern analysis
Predictive Analytics: Predictive threat detection

Enhanced Protection

Formal Verification: Mathematical proof of security properties
Decentralized Oracle Networks: Improved oracle security
Cross-Chain Security: Multi-chain security coordination

Research Areas

Quantum-Resistant Cryptography

Post-Quantum Algorithms: Quantum-resistant cryptographic primitives
Key Migration: Secure migration to quantum-resistant systems
Hybrid Schemes: Combined classical and quantum security

Advanced Fraud Detection

Graph Analysis: Network-based fraud detection
Temporal Patterns: Time-based anomaly detection
Cross-Platform Analysis: Multi-platform correlation

📋 Security Checklist

Pre-Deployment

Post-Deployment

🎯 Security Goals and Metrics

Security Objectives

Confidentiality

Protect sensitive market and user data
Ensure privacy of user transactions
Maintain confidentiality of oracle data sources

Integrity

Ensure market outcomes remain unaltered
Prevent manipulation of betting odds
Maintain accuracy of oracle data

Availability

Ensure system remains operational under attack
Provide graceful degradation during failures
Maintain service availability for legitimate users

Accountability

Track all administrative actions
Provide comprehensive audit trails
Enable forensic analysis of security events

Success Metrics

Security Metrics

Mean Time to Detect (MTTD): < 5 minutes for critical events
Mean Time to Respond (MTTR): < 30 minutes for critical incidents
False Positive Rate: < 5% for security alerts
System Uptime: > 99.9% availability
Authentication Success Rate: > 99.95% for legitimate users

Quality Metrics

Test Coverage: ≥95% line coverage on security modules
Code Review: 100% security code review coverage
Security Score: A+ grade on security assessments
Vulnerability Density: < 1 vulnerability per 10,000 lines of code

This document serves as the authoritative reference for Predictify Hybrid security architecture and should be updated whenever new security features are implemented or threats are identified.

GDPR: General Data Protection Regulation permits individuals the right to ask organisations to delete their personal data.

FilesExpand file tree

SECURITY_CONSIDERATIONS.md

Latest commit

History