Polymarket的幽灵：当链下交易与链上交易相遇时，会发生什么？
The Ghosts of Polymarket: When Off-Chain Matches Meet On-Chain Reverts
摘要
Polymarket已经成为了一个非常出色的预测市场平台，同时也是DeFi领域发展最快的应用之一。为了实现低延迟的交易，该平台采用了混合式架构：订单在链下进行匹配，但在链上完成最终的执行过程。不过，这种设计也带来了一种“一致性问题”——即一些在链下成功匹配的订单，在链上结算时可能会失败。为了了解这个问题的安全影响，我们开发了GHOSTHUNTER工具来分析这些失败的结算情况，该工具能够从链上的交易记录中重建这些事件，并将其归因于具体的攻击模式。通过对1,952,440笔被撤销的匹配订单进行分析，我们发现攻击者利用了匹配和结算之间的时间差，使得那些已经匹配的订单在链上最终执行之前就被撤销了。我们从这些事件中发现了四种攻击手段：随机数注入、余额消耗、许可撤销以及代理陷阱。通过这些攻击手段，攻击者能够选择性地撤销980,133笔已完成的订单，从而实现无风险的投资、套利操作以及流动性操纵。至少获得了149万美元的利润，但同时也导致了178亿美元的风险暴露，以及由操作员支付的217万POL（约21.2万美元）的损失。在高峰时段，超过24.3%的已完成订单被撤销，这实际上相当于一次拒绝服务攻击。我们还发现，那些存在漏洞的合约代码仍然存在于10条链上的167个独立合约中，这些合约至少占用了2300万美元的用户资金，其影响范围甚至超出了Polymarket本身。我们已经向相关方公开了我们的证据，这个问题已经得到了部分缓解。
English Abstract
Polymarket has emerged as a prominent prediction market platform and one of the fastest-growing applications in DeFi. To achieve low-latency trading, it adopts a hybrid architecture that matches orders off-chain but settles them on-chain for final execution. This design creates a consistency gap we call Ghost Fills: an order that is successfully matched off-chain may later fail during on-chain settlement. To understand the security implications of this gap, we investigate such failed settlements by building GHOSTHUNTER, which reconstructs them from on-chain traces and attributes to concrete attack patterns. Across 1,952,440 reverted match-order transactions, we find that attackers exploit the time gap between matching and settlement to invalidate already matched orders before they are finalized on-chain. We then identify four attack vectors from these incidents: nonce bump, balance drain, allowance revoke, and proxy trap, realized via 35 evolving variants. These vectors allow attackers to selectively revert 980,133 filled orders, enabling risk-free prediction, arbitrage-bot hunting, and liquidity reward manipulation, realizing at least \1.49M in profit, which places 1.78 B USD at risk and 2.17 M POL (about \212 K) paid by operator. During peak hours, more than 24.3% of all filled orders reverted, causing de facto DoS attacks. We also find that code derived from the flawed contract still appears in 167 independent contracts across 10 chains holding at least 23 M in user funds, extending the impact beyond Polymarket. We have disclosed our evidence to affected parties, and the issue has been partially mitigated.