Scan to download
BTC $76,710.25 -1.90%
ETH $2,284.29 -3.50%
BNB $622.29 -2.04%
XRP $1.39 -3.07%
SOL $84.10 -3.24%
TRX $0.3256 +0.50%
DOGE $0.0975 -1.64%
ADA $0.2448 -3.22%
BCH $448.19 -1.19%
LINK $9.21 -3.13%
HYPE $41.49 -0.41%
AAVE $95.61 -1.65%
SUI $0.9219 -2.67%
XLM $0.1644 -3.84%
ZEC $352.20 -1.69%
BTC $76,710.25 -1.90%
ETH $2,284.29 -3.50%
BNB $622.29 -2.04%
XRP $1.39 -3.07%
SOL $84.10 -3.24%
TRX $0.3256 +0.50%
DOGE $0.0975 -1.64%
ADA $0.2448 -3.22%
BCH $448.19 -1.19%
LINK $9.21 -3.13%
HYPE $41.49 -0.41%
AAVE $95.61 -1.65%
SUI $0.9219 -2.67%
XLM $0.1644 -3.84%
ZEC $352.20 -1.69%

chr

GoPlus: Polymarket Hacked, Flaws in Off-Chain and On-Chain Transaction Result Synchronization Mechanism

According to disclosures from the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain trading results in its order system.The attacker manipulated the nonce, causing on-chain matched trades to be canceled or invalidated before execution, while off-chain records remained valid, leading to API false reports that affected trading behaviors of bots like Negrisk, resulting in user losses. The analysis of the attack process is as follows:The attacker submitted/matched large reverse trades with the market-making bot on the Polymarket off-chain orderbook.The attacker constructed transactions with forged/repeated nonces or utilized on-chain nonce competition, causing the on-chain transactions to inevitably revert.The Polymarket API returned "transaction successful" to the bot before on-chain confirmation, leading the bot to believe that the position had been hedged, while the actual on-chain state had not changed.The attacker then executed real on-chain trades to take advantage of the direction exposed by the bot, thus profiting "risk-free."Since the revert occurred at the chain level, Polymarket fees would not explode, making the attack cost controllable and executable continuously.GoPlus recommends that users pause automated trading tools, verify on-chain trading statuses, enhance wallet security, and closely monitor official announcements from Polymarket.
app_icon
ChainCatcher Building the Web3 world with innovations.