Polymarket hacked, with vulnerabilities in the off-chain and on-chain transaction result synchronization mechanism

ChainCatcher reports that, according to the GoPlus Chinese community, the prediction market platform Polymarket was hacked due to a design flaw in the synchronization mechanism between off-chain and on-chain transaction results in its order system.

The attacker manipulated nonces to cause on-chain matched transactions to be canceled or invalidated before settlement, while off-chain records remained valid, leading to API false positives, affecting trading bots like Negrisk and causing user losses. The attack process is as follows: 1. The attacker submits or matches large reverse trades with market-making bots on Polymarket's off-chain order book. 2. The attacker constructs transactions with forged or duplicate nonces or exploits on-chain nonce competition, ensuring the on-chain transaction reverts. 3. Polymarket's API returns "Trade Successful" to the bot before on-chain confirmation, causing the bot to believe the position has been hedged, while the on-chain state has not yet changed. 4. The attacker then exploits the exposed direction by executing a real on-chain transaction, achieving "risk-free" profit. 5. Since the revert occurs on the blockchain layer, Polymarket's fees do not explode, making the attack cost manageable and sustainable. GoPlus recommends users pause automated trading tools, verify on-chain transaction statuses, strengthen wallet security, and closely monitor official Polymarket announcements.