Polymarket的幽靈：當鏈下匹配遇到鏈上回滾

摘要

Polymarket 已成為知名的預測市場平台，也是 DeFi 中成長最快的應用之一。為了實現低延遲交易，它採用混合架構，在鏈下進行訂單配對，但在鏈上結算以完成最終執行。這種設計造成了一致性落差，我們稱之為「幽靈成交」（Ghost Fills）：一個成功在鏈下配對的訂單，可能在後續的鏈上結算中失敗。為了解這個落差的安全隱含，我們透過建立 GHOSTHUNTER 來調查此類失敗結算，該工具從鏈上足跡重建這些交易，並歸因出具體的攻擊模式。在 1,952,440 筆被撤銷（reverted）的配對訂單交易中，我們發現攻擊者利用配對與結算之間的時間差，在已配對的訂單於鏈上最終確定前使之失效。我們進而從這些事件中識別出四種攻擊向量：隨機數提升（nonce bump）、餘額耗盡（balance drain）、授權撤銷（allowance revoke）與代理陷阱（proxy trap），並透過 35 種演變中的變體實現。這些向量使攻擊者能夠選擇性地撤銷 980,133 筆已成交訂單，從而實現無風險預測、套利機器人獵殺及流動性獎勵操縱，獲利至少 149 萬美元，這導致 17.8 億美元資金面臨風險，並使營運商支付了 217 萬 POL（約 21.2 萬美元）。在尖峰時段，超過 24.3% 的已成交訂單被撤銷，形同事實上的拒絕服務攻擊。我們還發現，源自有缺陷合約的程式碼仍出現在橫跨 10 條鏈的 167 個獨立合約中，這些合約持有至少 2,300 萬美元的用戶資金，將影響範圍擴展至 Polymarket 之外。我們已將證據揭露給受影響方，該問題已獲得部分緩解。

English

Polymarket has emerged as a prominent prediction market platform and one of the fastest-growing applications in DeFi. To achieve low-latency trading, it adopts a hybrid architecture that matches orders off-chain but settles them on-chain for final execution. This design creates a consistency gap we call Ghost Fills: an order that is successfully matched off-chain may later fail during on-chain settlement. To understand the security implications of this gap, we investigate such failed settlements by building GHOSTHUNTER, which reconstructs them from on-chain traces and attributes to concrete attack patterns. Across 1,952,440 reverted match-order transactions, we find that attackers exploit the time gap between matching and settlement to invalidate already matched orders before they are finalized on-chain. We then identify four attack vectors from these incidents: nonce bump, balance drain, allowance revoke, and proxy trap, realized via 35 evolving variants. These vectors allow attackers to selectively revert 980,133 filled orders, enabling risk-free prediction, arbitrage-bot hunting, and liquidity reward manipulation, realizing at least \1.49M in profit, which places 1.78 B USD at risk and 2.17 M POL (about \212 K) paid by operator. During peak hours, more than 24.3% of all filled orders reverted, causing de facto DoS attacks. We also find that code derived from the flawed contract still appears in 167 independent contracts across 10 chains holding at least 23 M in user funds, extending the impact beyond Polymarket. We have disclosed our evidence to affected parties, and the issue has been partially mitigated.