Rain / Prediction Markets
Hacken reviewed RAIN (Rain / Prediction Markets) on 5 Jun 2026: 49 findings, 0 critical; 40 marked fixed, 8 acknowledged, 1 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings49
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 2 |
| Medium | 0 | 4 | 8 |
| Low | 1 | 3 | 30 |
HighInverted Arguments in _swapTokenForWETHV2 Bypass RAIN Burn and Block Settlements Across All V2 Non-WETH MarketsFixed
The report gives no description here.
HighswapAndBurn Catch Drains Pooled Reserves and Strands WETHFixed
The report gives no description here.
MediumcalculateWinnerReadOnly Return Value Ignored, Permanently Blocking claimFixed
The report gives no description here.
MediumenterOption AMM Path Lacks minSharesOut and deadline, Exposing Users to Ordering-Driven SlippageFixed
The report gives no description here.
MediumgetEntryShares Preview Diverges From enterOption On Multi-Tick OrdersFixed
The report gives no description here.
MediumNo Post-Only Option in placeSellOrder and placeBuyOrder Forces Intended Makers to Pay Taker FeesFixed
The report gives no description here.
MediumOn-chain Quoter Calls in swapAndBurn Cause enterOption to Exhaust Gas on Large OB OrdersFixed
The report gives no description here.
MediumtooEarly Seizes the User Supplied Bond Instead of Refunding itFixed
The report gives no description here.
MediumUnwrapped Base-to-WETH Dispatch in swapAndBurn Rolls Back Matched FillsFixed
The report gives no description here.
MediumZero-Fill Dust Orders Fail to Terminate Order-Book Walks, Corrupting Head-of-Book PointersFixed
The report gives no description here.
Show 10 more
LowcancelSellOrders and cancelBuyOrders Fail to Advance firstSellOrderPrice and firstBuyOrderPrice, Causing Stale Price ReadsFixed
The report gives no description here.
LowChecks-Effects-Interactions Violation in claim Sets One-Shot Latch After Resolver CallbacksFixed
The report gives no description here.
LowcreatePool Uses Raw transferFrom for the Two Oracle-Fee PullsFixed
The report gives no description here.
LowDiamond Does Not Register supportedInterfaces for EIP-165 / EIP-2535Fixed
The report gives no description here.
LowenterLiquidity / enterLiquidityBatch / removeLiquidity Lack minYesOut / minNoOut and deadline, Exposing LPs to Uncontrolled Position CompositionFixed
The report gives no description here.
LowenterLiquidityBatch Skip Logic Reverts; Enables Cheap DoSFixed
The report gives no description here.
LowFee Setters Lack Upper-Bound Validation Brick Future Pools' ResolutionFixed
The report gives no description here.
LowFloating PragmaFixed
The report gives no description here.
LowIncorrect NatSpec in _calculateNumberOfOracles Misstates Oracle Base CountFixed
The report gives no description here.
LowIncorrect NatSpec in _calculateNumberOfOracles Misstates Oracle SizingFixed
The report gives no description here.
Show 10 more
LowIncorrect Token Address Passed to _swapTokenForWETHV2 and _swapTokenForWETHV3 Grants Unnecessary WETH AllowanceFixed
The report gives no description here.
LowIRainDeployer.initialize Interface Diverges; Silent Parameter ShiftFixed
The report gives no description here.
LowLow Order Execution Fee on Post-Creator-Fee Base Underfunds ProtocolFixed
The report gives no description here.
LowMissing and Mis-Ordered option Bounds Checks in Resolution and Dispute Facets Surface Misleading RevertsFixed
The report gives no description here.
LowMissing Events on Privileged Setters Across the CodebaseFixed
The report gives no description here.
LowMissing Minimum Amount Check in enterOption Allows Fee-Free Trades, Reducing LP ReturnsFixed
The report gives no description here.
LowMissing Zero-Address Validation in RainDeployerFixed
The report gives no description here.
LowOdd Creator Fee in referrerCreatorClaim Strands One Wei Per CallFixed
The report gives no description here.
LowopenDispute Emits ResolverSet With the Stale Pool-Level Resolver Instead of the Just-Assigned Per-Option ResolverFixed
The report gives no description here.
LoworacleFixedFee Incorrectly Paid to disputeResolver Instead of poolOwner on Disputed but Non-Appealed PoolsFixed
The report gives no description here.
Show 10 more
LowPHASE_B_DELAY Freezes Order Book for 60s on Late closePoolFixed
The report gives no description here.
LowplaceSellOrder, placeBuyOrder, and enterOption Advance Best-Price Pointers Beyond Valid Tick Bounds When No Remaining Orders ExistFixed
The report gives no description here.
LowPlatformClaim Unconditionally Emitted at End of swapAndBurnFixed
The report gives no description here.
LowPost-Bootstrap LP Deposit Below Share Value Mints 0 SharesFixed
The report gives no description here.
LowsetBaseToken Retroactively Breaks createOracle for Every Pre-Existing PoolFixed
The report gives no description here.
LowswapAndBurn Dead else Branch Silently Transfers baseToken if Activated by Future RefactorFixed
The report gives no description here.
LowswapAndBurn Quoter Revert Disables Slippage, Enables MEV SandwichFixed
The report gives no description here.
LowUnguarded refund in _firstClaimCheck Can Lock Option FundsFixed
The report gives no description here.
LowUniswapV2Library pairFor Uses the Canonical Init-Code Hash and Computes Wrong Pair Addresses for All Non-Canonical V2 ForksFixed
The report gives no description here.
LowUnsafe uint128 Cast Without SafeCast at Four V4 Quote Sites Allows Silent Swap Amount TruncationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (23)
- src/shared/Constants.sol
- src/libraries/helpers/SafeMath.sol
- src/diamond/RainPoolDiamond.sol
- src/diamond/facets/DisputeFacet.sol
- src/RainDeployer.sol
- src/diamond/facets/InfoFacet.sol
- src/diamond/libraries/LibDiamond.sol
- src/diamond/facets/TradingFacet.sol
- src/utils/Globals.sol
- src/diamond/libraries/PathKey.sol
- src/diamond/facets/GetterFacet.sol
- src/diamond/facets/CancelOrderFacet.sol
- src/diamond/facets/ResolutionFacet.sol
- src/diamond/libraries/LibUtils.sol
- src/diamond/facets/DiamondCutFacet.sol
- src/libraries/helpers/UniswapV2Library.sol
- src/RainDiamondFactory.sol
- src/diamond/shared/Types.sol
- src/libraries/LinkedList.sol
- src/diamond/facets/OracleFeeFacet.sol
- src/diamond/facets/DiamondLoupeFacet.sol
- src/diamond/facets/ClaimFacet.sol
- src/diamond/facets/SplitMergeFacet.sol
Part of RAIN’s security record
RAINSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us