Truth Network

We express our gratitude to the Truth Network team for the collaborative engagement that enabled the execution of this dApp Security Assessment.

SI Predict represents a significant evolution in sports media, aligning with the growing trend of interactive and participatory fan experiences. By integrating prediction markets into the sports viewing experience, Sports Illustrated and Galactic are positioning themselves at the forefront of this emerging sector .

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

The documentation for the Prediction Market monorepo is well-structured and developer-friendly. It clearly outlines the architecture (apps, packages, and config layers), includes practical setup and infrastructure commands, and provides helpful development workflows using pnpm and Turborepo. It emphasizes consistency through shared configs and demonstrates good practices for scalable, modular app development.

Code quality

The codebase is well-structured, leveraging a clean monorepo setup with clear separation of concerns across backend, frontend, and shared packages. Configuration and tooling are thoughtfully organized, supporting scalable development.

However, during our review, we identified several critical quality issues:

• Access Control Gaps: Inadequate authorization checks across sensitive endpoints, potentially exposing user or system-level data.

• Logical Flaws: Business logic inconsistencies in prediction handling and transaction flows, which could lead to incorrect or exploitable outcomes.

• Missing Validations: Insufficient input validation, increasing the risk of invalid data entering the system.

• Error Handling Weaknesses: Several areas lack robust error management, reducing system reliability under edge-case scenarios.

While the structural foundation is solid, the implementation requires significant attention to security, logical correctness, and defensive coding practices to ensure production readiness.

The Prediction Market project is a full-stack decentralized application (DApp) designed to facilitate interactive prediction experiences, likely in contexts such as sports or live events. The system is organized as a monorepo managed using Turborepo and built with modern technologies like NestJS, Next.js, and pnpm.

Core Components

• API Layer (api) A backend application built with NestJS, handling business logic, API endpoints, and integrations with services like PostgreSQL and AWS (via LocalStack).

• Frontend DApp (web) A Next.js application serving the user interface for end-users to engage with prediction markets in real-time.

• Shared Packages Modular packages such as @repo/types, @repo/logger, and @repo/utils promote reusability and consistency across the codebase.

• UI Library (@repo/ui) A component library based on shadcn/ui, providing standardized design components for the frontend.

• DevOps & Tooling Includes infrastructure scripts to manage local services (Postgres, LocalStack), as well as configuration packages for TypeScript, ESLint, and Jest, ensuring consistent development workflows.

The scope of the project includes the following:

Assets in Scope