Polymarket hacked, with vulnerabilities in the off-chain and on-chain transaction result synchronization mechanism

ChainCatcher reports that, according to the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain transaction results in its order system.

The attacker manipulated nonces to cause on-chain matched transactions to be canceled or invalidated before settlement, while off-chain records remained valid, leading to API false positives, affecting trading bots like Negrisk and causing user losses. The attack process is as follows: 1. The attacker submits or matches large reverse trades with market-making bots on Polymarket’s off-chain order book. 2. The attacker constructs transactions with forged or duplicate nonces or exploits on-chain nonce competition, ensuring the on-chain transaction reverts. 3. Polymarket’s API returns “Trade Successful” to the bot before on-chain confirmation, causing the bot to believe the position has been hedged, while the on-chain state has not yet changed. 4. The attacker then exploits the exposed direction by executing a real on-chain transaction, achieving “risk-free” profit. 5. Since the revert occurs on the blockchain layer, Polymarket’s fees do not explode, making the attack cost manageable and sustainable. GoPlus recommends users pause automated trading tools, verify on-chain transaction statuses, strengthen wallet security, and closely monitor official Polymarket announcements.

View Original
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.

Related Articles

A Step-by-Step Guide to Earning Polymarket LP Rewards

This article explains how to conduct market-making operations on Polymarket to earn liquidity provider (LP) rewards. The author explains the concepts of Makers and Takers, emphasizing how order volume, order duration, and order price affect rewards. The article provides criteria for selecting suitable markets for market-making, including order book depth and competition level, and describes in detail the strategies and considerations for placing orders, aimed at helping beginner users get started with the operations.

PANews1h ago

NCAA "March Madness" begins on March 18, Polymarket data shows Duke University has a 21% championship probability, currently ranking first

NCAA "March Madness" will begin on March 18th, with 68 college teams competing for the championship through single-elimination games. According to real-time odds from Polymarket, Duke University, University of Michigan, University of Arizona, and University of Florida are the top four teams ranked by championship odds.

GateNews2h ago

Polymarket's BLG vs BFX League of Legends match prediction has nearly a million dollars in trading volume, with two addresses betting $120,000 on BLG to win

Polymarket predicts that the trading volume for today's 21:00 League of Legends match between BLG and BFX will reach 986,000 USD. Major accounts betting on BLG's victory have respectively purchased 100,000 and 90,000 shares. The International Pioneer Championship features 8 teams in total, with matches using a BO5 format.

GateNews2h ago

2026 Oscar Winners Announced! Polymarket Surges with $200 Million in Volume, Someone Wins Big Prize Worth Around 5 Million Taiwan Dollars

The 98th Academy Awards in 2026 have been announced, with "Fight Again" emerging as the big winner, taking home 6 awards including Best Picture. Michael B. Jordan pulled off an upset to win Best Actor, allowing trader NeoWick to earn $2.8 million from it. This year's Oscars set multiple records, with "Sinners," which received the most nominations, winning 4 awards, while Amy Maddigan became an actress who won an award for the first time in 35 years.

CryptoCity2h ago

Geopolitical Domain 80% Win Rate Address Bets $83,600 That US Military Won't Enter Iran Before April

March 16 News: Prediction market Polymarket shows that bets on "U.S. military will not enter Iran before April" have surged significantly, with someone investing $83,600 to successfully raise the probability to 73%. Trump plans to establish an international coalition to ensure the security of the Strait of Hormuz; however, Gulf countries deny providing support for military operations. Despite Iran's attacks on Israel and U.S. military bases, the United States' response remains focused on maintaining freedom of navigation through the strait.

GateNews2h ago

Three accounts on a certain prediction market platform simultaneously wagered $60,000 on "The United States will not invade Cuba in 2026"

On March 16, three accounts on a certain prediction market platform collectively wagered $60,000, predicting that "the United States will not invade Cuba in 2026." In early 2026, the United States escalated sanctions against Cuba, leading to fuel shortages and power outages in Cuba, with escalating tensions and increased domestic protests.

GateNews3h ago
Comment
0/400
No comments