When Depth Becomes an Illusion: Polymarket Faces 'Order Attack' Stress Test
A sophisticated "order attack" is exploiting a critical vulnerability in Polymarket's hybrid off-chain matching/on-chain settlement system. For less than $0.10 in gas fees on Polygon, an attacker can initiate a trade and then, in the brief window before on-chain execution, drain their wallet via a high-gas transfer. This causes the initial trade to fail on-chain due to insufficient funds. However, Polymarket's off-chain system responds by forcibly removing all the legitimate market maker orders that were matched with the failed transaction.
This attack has two primary profit methods. First, attackers clear the order book of competitors, create a liquidity vacuum, and then place their own orders with artificially wide spreads to monopolize trading. Second, they "hunt" automated trading bots: after a trade is matched off-chain, a bot hedges its new position, but the attacker then forces the original trade to fail on-chain. This leaves the bot with an unhedged, risky position, which the attacker exploits for profit.
One identified attacker address, created in February 2026, reportedly profited over $16,000 in a single day by targeting just 7 markets. The attack severely undermines market maker confidence, threatens the platform's liquidity, and exposes a fundamental design flaw. While the community has developed monitoring tools, Polymarket team has not yet issued an official fix.
比推02/26 04:52
