Canton Predict — Security Checklist

1. AMM / LMSR Manipulation

Vector	Risk	Mitigation
Sandwich attacks	Medium	Single-party Canton ledger eliminates MEV; no mempool. Canton's sequencer provides fair ordering.
Flash loan price manipulation	Low	No composable flash loans on Canton. LMSR is self-contained.
Share quantity overflow	High	Enforced cap: maxShares = 100 * b. Int64 overflow checked at contract level.
Rounding exploit (buy 1 share, sell 1 share repeatedly)	Medium	Round-against-user policy ensures each round-trip costs the user at least 2 units (0.000002 CC).
Extreme b parameter	High	b validated: b >= 100 * SCALE and b <= 10000 * SCALE. Operator-only configuration.
Cost function numerical instability	Medium	logSumExp form avoids exp overflow. Taylor series bounded to 12 terms. Input range capped.

2. Oracle Attacks

Vector	Risk	Mitigation
Price manipulation at fixing time	High	MVP: use volume-weighted price from multiple sources. Production: Chainlink Data Streams with TWAP.
Oracle downtime / failure	High	30-minute deadline. No oracle = CancelAndRefund. Users get full refund.
Stale price / delayed oracle	Medium	Timestamp validation. OracleFixing must be within 5 minutes of requested time.
Oracle front-running	Medium	Oracle party has no trading permissions. Separate Daml party with signatory isolation.
Compromised oracle key	Critical	Production: multi-sig oracle. Chainlink decentralized oracle network. Canton party key rotation.

3. Contract / Ledger Security

Vector	Risk	Mitigation
Unauthorized trade submission	Low	Daml authorization model: controller buyer ensures only the buyer party can exercise BuyShares.
Double-claim	Low	Boolean claimed flag on Position. Daml contract consumption prevents double-exercise.
Position spoofing	Low	Position requires signatory operator, owner. Cannot be created without operator co-signature.
Concurrency on qUp/qDown	Medium	Daml's consumption model: DailyMarket contract is consumed and recreated on each trade. Two concurrent trades will conflict — one will be rejected and retried. This is correct behavior for an AMM.
Market state transition bypass	Low	Each choice validates status with assertMsg. State machine enforced in contract.

4. Backend / API Security

Vector	Risk	Mitigation
API injection	Medium	Zod input validation on all endpoints. Parameterized SQL queries.
Read model desync	Medium	Ledger event stream is the source of truth. Read model is append-only with upserts. Periodic reconciliation job.
Unauthorized API access	High	Production: JWT auth tied to Canton party identity. API rate limiting. CORS whitelist.
DDoS on quote endpoint	Medium	Quote computation is pure math (no ledger interaction). Rate limit per IP. CDN caching.

5. Frontend Security

Vector	Risk	Mitigation
XSS	Medium	React's default escaping. CSP headers via nginx. No dangerouslySetInnerHTML.
Wallet key exposure	Medium	MVP: party ID only (not a private key). Production: Canton wallet SDK with proper key management.
Price display manipulation	Low	All prices computed server-side from ledger state. Frontend is display-only.

6. Economic / Griefing Attacks

Vector	Risk	Mitigation
Market draining	Medium	Max loss bounded by b * ln(2). Platform funds the AMM up to this amount.
Dust trading (spam)	Low	Minimum trade: 1 share. 2% fee makes micro-trades unprofitable for attackers.
Wash trading	Low	Fee makes wash trading costly. No volume-based rewards to game.
Late trading (just before close)	Medium	Trading closes at 23:55 UTC (5 minutes before settlement). Reduces last-second information advantage.
Price pinning (force flat close)	Low	BTC price is determined by global markets, not this platform. Not manipulable by participants.

7. Operational Security

• Operator key stored in HSM (production)
• Oracle key rotation policy (quarterly)
• Database backups (daily, encrypted, off-site)
• Ledger backup via Canton participant dump
• Monitoring: alerts on oracle failures, unusual trade volumes, contract errors
• Incident response plan for oracle compromise
• Rate limiting on all public endpoints
• Audit trail: all Daml transactions immutable on ledger