Security Model#

// Read raw bytes from the AccountView and compare the leading 8 bytes.
let data = account.try_borrow_data()?;
if data[..8] != T::DISCRIMINATOR {
    return Err(SeesawError::InvalidAccountType.into()); // 0x5001
}

let (expected, _bump) = find_program_address(seeds, &crate::ID);
if account.key() != &expected {
    return Err(SeesawError::InvalidPDA.into()); // 0x5003
}

// Re-derive market PDA from its full seed set + stored bump.
let expected = create_program_address(
    &[
        b"seesaw",
        b"market",
        &pyth_feed_id,
        &duration_seconds.to_le_bytes(),
        &market_id.to_le_bytes(),
        creator.as_ref(),
        &[market.bump],
    ],
    program_id,
)?;
if market.key() != &expected {
    return Err(SeesawError::InvalidPDA.into());
}

// During creation
market.bump = bump;

// During use — the full seed set plus the stored bump signs/verifies the PDA
let seeds = &[
    b"seesaw",
    b"market",
    &pyth_feed_id,
    &duration_seconds.to_le_bytes(),
    &market_id.to_le_bytes(),
    creator.as_ref(),
    &[market.bump],
];

// WRONG
let result = a + b; // Can overflow

// RIGHT
let result = a.checked_add(b).ok_or(Error::MathOverflow)?;

// Taker fee uses capped-linear-decay: fee_bps(p) = min(fee_cap_bps, decay_rate_bps * (10_000 - p) / 10_000)
// Fees round UP (protocol receives more)
fn calculate_taker_fee(amount: u64, price_bps: u16, fee_cap_bps: u16, decay_rate_bps: u16) -> u64 {
    let raw = (decay_rate_bps as u64)
        .saturating_mul(10_000u64.saturating_sub(price_bps as u64))
        / 10_000u64;
    let fee_bps = raw.min(fee_cap_bps as u64);
    // Ceiling division
    (amount.saturating_mul(fee_bps).saturating_add(9_999)) / 10_000
}

// Payouts round DOWN (protocol pays less)
fn calculate_payout(shares: u64, price_bps: u16) -> u64 {
    shares * (price_bps as u64) / 10_000  // Floor division
}

// Bids round DOWN (buyer pays less)
fn round_bid(price: u16, tick: u16) -> u16 {
    (price / tick) * tick
}

// Asks round UP (seller receives more)
fn round_ask(price: u16, tick: u16) -> u16 {
    let rem = price % tick;
    if rem == 0 { price } else { price + tick - rem }
}

fn validate_state_transition(
    current: MarketState,
    instruction: Instruction,
) -> Result<()> {
    let valid = match (current, instruction) {
        (Pending, CreateMarket) => true,
        (Trading, PlaceOrder) => true,
        (Trading, CancelOrder) => true,
        (Trading, SnapshotEnd) => true,
        (Settling, ResolveMarket) => true,
        (Resolved, Redeem) => true,
        (Resolved, CloseMarket) => true,
        _ => false,
    };

    require!(valid, Error::InvalidStateTransition);
    Ok(())
}

fn validate_timing(
    market: &MarketAccount,
    instruction: Instruction,
    clock: &Clock,
) -> Result<()> {
    match instruction {
        SnapshotEnd => {
            require!(clock.unix_timestamp >= market.t_end, Error::TooEarly);
        }
        PlaceOrder => {
            require!(clock.unix_timestamp < market.t_end, Error::TradingEnded);
        }
        _ => {}
    }
    Ok(())
}

let price = read_pyth_price(pyth_price_account)?; // validates discriminator + Full verification
if price.feed_id != market.pyth_feed_id { return Err(SeesawError::OracleMismatch.into()); }
if price.price <= 0 { return Err(SeesawError::InvalidPrice.into()); }
if price.publish_time < boundary { return Err(SeesawError::StaleOracle.into()); }

fn capture_snapshot(market: &mut MarketAccount, price: i64) -> Result<()> {
    // Idempotency check
    if market.start_price != 0 {
        return Ok(()); // Already captured, no-op
    }

    market.start_price = price; // Immutable after this
    Ok(())
}

fn validate_sell_order(
    position: &UserPositionAccount,
    side: OrderSide,
    quantity: u64,
) -> Result<()> {
    let available = match side {
        SellYes => position.yes_shares - position.locked_yes_shares,
        SellNo => position.no_shares - position.locked_no_shares,
        _ => return Ok(()), // Not a sell
    };

    require!(quantity <= available, Error::InsufficientShares);
    Ok(())
}

fn validate_buy_order(
    user_balance: u64,
    locked_collateral: u64,
    price_bps: u16,
    quantity: u64,
) -> Result<()> {
    let required = (price_bps as u64)
        .checked_mul(quantity)
        .ok_or(Error::Overflow)?
        .checked_div(10_000)
        .ok_or(Error::Overflow)?;

    let available = user_balance - locked_collateral;

    require!(required <= available, Error::InsufficientCollateral);
    Ok(())
}

vault.balance >= max(total_yes_shares, total_no_shares)
                 + accumulated_creator_fees

fn redeem(position: &mut UserPositionAccount) -> Result<()> {
    // Check BEFORE any state change
    if position.settled {
        return Ok(()); // Already settled, no-op
    }

    // Calculate and transfer payout...

    position.settled = true; // Atomic with transfer
    Ok(())
}