Polymarket hacked, with vulnerabilities in the off-chain and on-chain transaction result synchronization mechanism

ChainCatcher reports that, according to the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain transaction results in its order system.

The attacker manipulated nonces to cause on-chain matched transactions to be canceled or invalidated before settlement, while off-chain records remained valid, leading to API false positives, affecting trading bots like Negrisk and causing user losses. The attack process is as follows: 1. The attacker submits or matches large reverse trades with market-making bots on Polymarket’s off-chain order book. 2. The attacker constructs transactions with forged or duplicate nonces or exploits on-chain nonce competition, ensuring the on-chain transaction reverts. 3. Polymarket’s API returns “Trade Successful” to the bot before on-chain confirmation, causing the bot to believe the position has been hedged, while the on-chain state has not yet changed. 4. The attacker then exploits the exposed direction by executing a real on-chain transaction, achieving “risk-free” profit. 5. Since the revert occurs on the blockchain layer, Polymarket’s fees do not explode, making the attack cost manageable and sustainable. GoPlus recommends users pause automated trading tools, verify on-chain transaction statuses, strengthen wallet security, and closely monitor official Polymarket announcements.

View Original
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.

Related Articles

High Win Rate Political Market Account Invested $75,200, Betting on US-Iran Ceasefire Before May

Political market data shows that a certain address bet on the United States and Iran reaching a ceasefire before May, with current odds at 39.5%. The U.S. demands Iran cease attacks, warning that if Iran cuts energy supplies, it will face strong retaliation. Iran's new leader emphasizes maintaining stability and demands the U.S. halt military operations. This trader may be conducting swing trades based on evolving geopolitical developments.

GateNews1h ago

Polymarket's new account deposits $20,000, betting that the US military will not enter Iran before the end of March

Polymarket report shows that on March 13, an account wagered $20,000 betting that the U.S. military will not enter Iran by March 31, with current odds at 75%. The Trump administration's strategy is dual-pronged: on one hand emphasizing that war is imminent to end, and on the other hand threatening to escalate response. Israel is pressuring the U.S. military for ground operations to eliminate Iran's nuclear threat.

GateNews1h ago

A high win-rate address invested $3700 betting on US escort of merchant ships through the Strait of Hormuz before April

On March 13, an investor wagered $3,700 on the Polymarket platform, betting that the United States will escort commercial vessels through the Strait of Hormuz by early April. U.S. Treasury Secretary Bessent stated that escort operations will be based on military conditions and international coalition cooperation, requiring air superiority to be established first. The trader may be executing a short-term profit-taking or stop-loss strategy.

GateNews2h ago

Polymarket Delists Weather Prediction Events for Hong Kong Region

Gate News reports that on March 13, Polymarket search results showed that weather prediction events related to Hong Kong have been delisted due to Wunderground's inability to provide historical weather data for Hong Kong. Additionally, weather prediction events for the Shanghai region have not yet been delisted.

GateNews2h ago

U.S. CFTC Issues First-Ever Predictive Market Manipulation Risk Guidance and Seeks Public Comment on Proposed Rules

The U.S. Commodity Futures Trading Commission has issued guidance on prediction market manipulation risks, requiring exchanges to consult with regulators before launching markets susceptible to manipulation. The guidance indicates that if contracts contradict public interest, they may be blocked, and sports contracts should cooperate with leagues to prevent insider trading.

GateNews6h ago

Polymarket Explores Funding Round at $20B Valuation Amid Traffic Surge

Gate News bot message, Polymarket is exploring a new funding round at approximately $20B valuation. The platform has experienced rapid growth in web traffic, reaching 38.4M monthly visits and ranking #2 among major platforms.

GateNews12h ago
Comment
0/400
No comments