[CRITICAL] `AccumulatedFees` is a global fungible pool with no per-market provenance — cross-market contamination on cancel

[grantfox-oss]

Summary

prediction_market/src/lib.rs stores all platform fees in a single global AccumulatedFees counter (lines ~1290-1348). Individual markets contribute to and withdraw from this pool with no per-market attribution. On cancel_market, the reclaim formula net_pool * TOTAL_FEE_BPS / (BPS_DENOM - TOTAL_FEE_BPS) attempts to reverse fees, but because funds from all markets are fungible, it is mathematically impossible to know which specific fees belong to which market.

Impact

• Cross-market contamination: market A's cancel_market can reclaim fees that were actually earned by market B, leaving market B's fee recipients underpaid.
• Fee theft: a malicious market creator can resolve a market with tiny stakes, inflate AccumulatedFees via the reclaim formula, and drain fees earned by other markets.
• Unrecoverable errors: once the accumulator is commingled, per-market fee isolation is impossible without a storage-level redesign.

Why it's unsolvable by a localized patch

• The fungible accumulator model is baked into the storage schema.
• Any per-market segregation requires a new storage layout: FeeLedger[market_id] with its own TTL and accounting.
• The current cancel_market reclaim logic assumes the formula is reversible, which it is not when fees are commingled.

Fix

• Replace the global AccumulatedFees with per-market FeeLedger[market_id] entries.
• Track fee provenance at place_bet time: credit net * PLATFORM_FEE_BPS / BPS_DENOM to FeeLedger[market_id].
• On cancel_market, only reclaim the market's own fees from its ledger entry.
• Migrate existing funds to the new model via a one-time upgrade migration.

[daRk8238]

Hello,
I can work on this
Could you please assign it to me
Thank you

[abimbolaalabi]

Hi Maintainer! I’m interested in contributing to this task and can ensure timely delivery with clean implementation. I’ve thoroughly read the issue description and understand the expected outcome. I’d love to work on it. Thank You!

[grantfox-oss]

🦊 GrantFox — @abimbolaalabi has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #178)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.