Scan to download
BTC $77,492.05 +4.41%
ETH $2,440.10 +5.02%
BNB $642.28 +2.42%
XRP $1.48 +4.08%
SOL $89.74 +3.67%
TRX $0.3264 -0.03%
DOGE $0.1010 +3.08%
ADA $0.2636 +4.17%
BCH $455.50 +3.60%
LINK $9.74 +3.46%
HYPE $44.63 +2.04%
AAVE $118.48 +5.72%
SUI $1.01 +4.21%
XLM $0.1742 +5.69%
ZEC $333.95 -0.94%
BTC $77,492.05 +4.41%
ETH $2,440.10 +5.02%
BNB $642.28 +2.42%
XRP $1.48 +4.08%
SOL $89.74 +3.67%
TRX $0.3264 -0.03%
DOGE $0.1010 +3.08%
ADA $0.2636 +4.17%
BCH $455.50 +3.60%
LINK $9.74 +3.46%
HYPE $44.63 +2.04%
AAVE $118.48 +5.72%
SUI $1.01 +4.21%
XLM $0.1742 +5.69%
ZEC $333.95 -0.94%

chr

GoPlus: Polymarket Hacked, Flaws in Off-Chain and On-Chain Transaction Result Synchronization Mechanism

According to disclosures from the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain trading results in its order system.The attacker manipulated the nonce, causing on-chain matched trades to be canceled or invalidated before execution, while off-chain records remained valid, leading to API false reports that affected trading behaviors of bots like Negrisk, resulting in user losses. The analysis of the attack process is as follows:The attacker submitted/matched large reverse trades with the market-making bot on the Polymarket off-chain orderbook.The attacker constructed transactions with forged/repeated nonces or utilized on-chain nonce competition, causing the on-chain transactions to inevitably revert.The Polymarket API returned "transaction successful" to the bot before on-chain confirmation, leading the bot to believe that the position had been hedged, while the actual on-chain state had not changed.The attacker then executed real on-chain trades to take advantage of the direction exposed by the bot, thus profiting "risk-free."Since the revert occurred at the chain level, Polymarket fees would not explode, making the attack cost controllable and executable continuously.GoPlus recommends that users pause automated trading tools, verify on-chain trading statuses, enhance wallet security, and closely monitor official announcements from Polymarket.
app_icon
ChainCatcher Building the Web3 world with innovations.