[MEDIUM] `create_market` allows `duration_secs = 0` and has no minimum duration — instantly-expired and griefable markets

[Muyideen-js]

[MEDIUM] create_market allows duration_secs = 0 and has no minimum duration — instantly-expired and griefable markets

Summary

create_market (prediction_market/src/lib.rs, lines ~278–325) computes end_time = env.ledger().timestamp() + duration_secs with no validation that duration_secs > 0:

let end_time = env.ledger().timestamp() + duration_secs;

If duration_secs = 0, the market is instantly expired — place_bet immediately returns MarketExpired (line ~349), so no one can ever bet. The admin can create such markets freely (subject only to the hourly rate limit), and there is no minimum-duration enforcement.

Why it's unsolvable by a localized patch

• Adding a duration_secs > 0 check is trivial, but it doesn't address the deeper issue: there is no minimum meaningful duration, so an admin can create a market that expires in 1 second, front-run a bet, and resolve it — a market-manipulation vector.
• The rate limit (MAX_MARKETS_PER_HOUR) limits count, not duration, so an attacker can flood the market list with useless instantly-expired markets, degrading the UI and the get_market_count-based indexers.
• There is no market-creation fee, so creating garbage markets is free (only gas).

The root problem is that market creation has no economic or temporal guardrails. A correct fix requires a minimum duration, a creation fee, and/or a maximum concurrent-market cap — a policy change, not a code fix.

Related

The same lack of guardrails affects resolve_market (issue #3) and the empty-side sweep.

[Aycode01]

I want to work on this issue because it highlights an important gap in the market creation rules: markets can currently be created without meaningful temporal or economic guardrails. While duration_secs = 0 is an obvious validation issue, the deeper concern is how extremely short-lived or spam markets could affect users, indexers, and the overall reliability of the prediction market.

I’m interested in working on this because it requires thinking beyond a single validation check and considering the appropriate constraints for market creation. I would like to investigate options such as minimum market duration, creation fees, and limits on concurrent markets, and understand the trade-offs each approach introduces.

This issue would also give me an opportunity to improve the contract’s defensive design and add tests around invalid durations, very short markets, market creation limits, and interactions with betting and resolution.

Ultimately, I want to work on this issue because establishing sensible guardrails at market creation is important for preventing abuse and ensuring that markets remain useful, predictable, and reliable for users.

[grantfox-oss]

🦊 GrantFox — @Aycode01 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #55)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@Aycode01's PR #201 was approved and merged by @Muyideen-js.

🏆 @Aycode01: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,308 total points). Track your full progress on GrantFox.

👏 Great work, @Aycode01! Keep contributing to SPulse-Org.