Polymarket hacked, with vulnerabilities in the off-chain and on-chain transaction result synchronization mechanism

ChainCatcher reports that, according to the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain transaction results in its order system.

The attacker manipulated nonces to cause on-chain matched transactions to be canceled or invalidated before settlement, while off-chain records remained valid, leading to API false positives, affecting trading bots like Negrisk and causing user losses. The attack process is as follows: 1. The attacker submits or matches large reverse trades with market-making bots on Polymarket’s off-chain order book. 2. The attacker constructs transactions with forged or duplicate nonces or exploits on-chain nonce competition, ensuring the on-chain transaction reverts. 3. Polymarket’s API returns “Trade Successful” to the bot before on-chain confirmation, causing the bot to believe the position has been hedged, while the on-chain state has not yet changed. 4. The attacker then exploits the exposed direction by executing a real on-chain transaction, achieving “risk-free” profit. 5. Since the revert occurs on the blockchain layer, Polymarket’s fees do not explode, making the attack cost manageable and sustainable. GoPlus recommends users pause automated trading tools, verify on-chain transaction statuses, strengthen wallet security, and closely monitor official Polymarket announcements.

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.

Related Articles

Polymarket’s daily revenue ranks 5th in crypto, as expectations for the POLY airdrop heat up

Polymarket achieved $1.71 million in daily revenue on April 3, and for the first time introduced a fee for multiple categories through a new rate structure. At the same time, users holding POLY tokens can receive a fee discount, enhancing the token’s utility. Polymarket’s prediction data is also favored by traditional financial markets, influencing the global oil futures market and further demonstrating its commercial potential.

MarketWhisper2h ago

Polymarket market odds on USD.ai launching the next day: 92% probability of exceeding $100 million in FDV

Gate News message, April 3, Polymarket prediction market data shows that the probability of USD.ai having an FDV over $100 million on the day after launch is 92%, the probability of over $150 million is 85%, and the probability of over $200 million is 50%. As of now, trading volume in this prediction market has already exceeded $2.5 million.

GateNews3h ago

Polymarket integrates the Pyth oracle and launches Tesla and Gold contracts

Polymarket has launched daily contracts tied to U.S. stocks and commodities, which are automatically settled using real-time price data from Pyth Network. The new contract formats include daily up-and-down contracts and settlement-price contracts, improving settlement efficiency and transparency. ICE is investing $600 million in Polymarket, signaling confidence in its potential.

MarketWhisper7h ago

A prediction platform adds a Genius open FDV prediction event, with a 74% probability of exceeding $100 million

Genius has published a new prediction event. Data shows that the probability that FDV exceeds $100 million after one day from opening is 74%, and the probability that it exceeds $200 million is 33%. At the same time, Genius announced it will complete the TGE by April 12, with a total airdrop amount of 70 million tokens.

GateNews7h ago

Polymarket and La Liga Reach Exclusive Partnership Agreement for Prediction Markets

Gate News reports that on April 3, Polymarket announced it has reached an exclusive prediction market partnership with Spain’s La Liga. La Liga becomes the first major European football league to partner with a prediction market platform. Following the agreement, official match prediction markets for teams such as Real Madrid and FC Barcelona will be available exclusively on Polymarket.

GateNews7h ago
Comment
0/400
No comments