[CRITICAL] `resolve_market` lets resolver sweep entire pool to fees by resolving to empty side

[grantfox-oss]

Summary

prediction_market/src/lib.rs resolve_market has no validation that the winning side actually has bettors. A resolver can call resolve_market(market_id, true) (Yes wins) even when total_yes == 0 — all XLM in the pool (from the losing side) is then treated as "fees" and credited to AccumulatedFees.

Impact

• Direct fund theft: the resolver redirects all user bets to the platform fee pool. Users who bet on the correct side get 0 payout; users who bet on the losing side lose everything.
• No revert or warning: the market simply resolves and there is no mechanism for users to challenge it.
• Single point of failure: the resolver role is typically a governance multisig, but a compromised or malicious resolver can execute this at any time.

Why it's hard

• The resolver is trusted by design — the market needs an oracle to determine the outcome.
• Adding a "challenge window" requires rethinking the entire settlement lifecycle.
• Distinguishing "legitimate outcome" from "malicious sweep" is impossible on-chain without external price feeds.

Fix

• Add a minimum bettor count / minimum pool size check before allowing resolution.
• Require that the winning side has at least one bettor.
• Emit a MarketResolved event with both sides' totals so off-chain monitors can flag suspicious resolutions.
• Add a dispute window before fees are claimable.

[daRk8238]

Hello,
I can work on this
Could you please assign it to me
Thank you

[OmniZlatoon]

Good day sir, Ready to deliver the task A.S.A.P. Gone through the issue and to be honest, i can work the task with the right tools at hand. please assign me maintainer . My eta is 5 hours

[OmniZlatoon]

Good day sir/ ma'am, I have 5 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

[grantfox-oss]

🦊 GrantFox — @OmniZlatoon has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #177)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.