Polymarket suffers hacker attack due to flaws in the synchronization mechanism between off-chain and on-chain transaction results
According to GoPlus Chinese Community, as reported by ChainCatcher, the prediction market platform Polymarket suffered a hacker attack due to a design flaw in the synchronization mechanism between off-chain and on-chain trading results in its order system.
The attacker manipulated the nonce, causing on-chain matched trades to be canceled or invalidated before settlement, while off-chain records remained effective. This led to API misreporting, affecting trading bots such as Negrisk and resulting in user losses. The attack process is analyzed as follows: 1. The attacker submits/matches large reverse trades with the market-making bot on Polymarket's off-chain orderbook. 2. The attacker constructs transactions with forged/duplicate nonces or exploits on-chain nonce competition, ensuring the on-chain transaction will revert. 3. The Polymarket API returns a "trade successful" message to the bot before on-chain confirmation, causing the bot to believe its position is hedged, while the actual on-chain state has not changed. 4. The attacker then executes real on-chain trades to take the exposed direction of the bot, thereby profiting "risk-free." 5. Since the revert occurs at the chain level, Polymarket fees do not explode, keeping attack costs controllable and allowing continuous execution. GoPlus recommends users pause automated trading tools, verify on-chain transaction status, enhance wallet security, and closely follow official Polymarket announcements.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Strategic Partners issues correction on senior manager transaction disclosure
This Analyst Just Discovered What’s Really Going On With XRP
Mare Group issues 500,000 shares for 2025-2027 stock option and stock grant plans
Dark Defender Here’s Why Ripple CEO Can’t Say a Price for XRP
