Polymarket的幽灵：当链下匹配遭遇链上回滚

摘要

Polymarket已成为一个突出的预测市场平台，也是DeFi领域增长最快的应用之一。为实现低延迟交易，它采用了混合架构：订单在链下匹配，但最终在链上结算执行。这种设计产生了一种我们称为"幽灵成交"的一致性缺口：一个成功在链下匹配的订单，后续可能在链上结算时失败。为探究这一缺口的安全隐患，我们通过构建GHOSTHUNTER系统，从链上交易记录中重建此类失败结算事件，并将其归因于具体攻击模式。在1,952,440笔被撤销的匹配订单交易中，我们发现攻击者利用匹配与结算之间的时间差，在已匹配订单最终上链确认前将其无效化。我们进一步从这些事件中识别出四种攻击向量：Nonce递增攻击、余额耗尽攻击、授权撤销攻击和代理陷阱攻击，它们通过35种演化变体实现。这些攻击向量使攻击者能够选择性撤销980,133笔已成交订单，从而实施无风险预测、抢跑机器人狩猎和流动性奖励操纵，至少获利149万美元，导致17.8亿美元资金面临风险，且操作者支付了217万POL代币（约21.2万美元）。在高峰期，超过24.3%的已成交订单被撤销，造成了事实上的拒绝服务攻击。我们还发现，源自存在缺陷合约的代码仍出现在10条链上的167个独立合约中，持有至少2300万美元的用户资金，将影响范围扩展至Polymarket之外。我们已向受影响方披露相关证据，该问题已得到部分缓解。

English

Polymarket has emerged as a prominent prediction market platform and one of the fastest-growing applications in DeFi. To achieve low-latency trading, it adopts a hybrid architecture that matches orders off-chain but settles them on-chain for final execution. This design creates a consistency gap we call Ghost Fills: an order that is successfully matched off-chain may later fail during on-chain settlement. To understand the security implications of this gap, we investigate such failed settlements by building GHOSTHUNTER, which reconstructs them from on-chain traces and attributes to concrete attack patterns. Across 1,952,440 reverted match-order transactions, we find that attackers exploit the time gap between matching and settlement to invalidate already matched orders before they are finalized on-chain. We then identify four attack vectors from these incidents: nonce bump, balance drain, allowance revoke, and proxy trap, realized via 35 evolving variants. These vectors allow attackers to selectively revert 980,133 filled orders, enabling risk-free prediction, arbitrage-bot hunting, and liquidity reward manipulation, realizing at least \1.49M in profit, which places 1.78 B USD at risk and 2.17 M POL (about \212 K) paid by operator. During peak hours, more than 24.3% of all filled orders reverted, causing de facto DoS attacks. We also find that code derived from the flawed contract still appears in 167 independent contracts across 10 chains holding at least 23 M in user funds, extending the impact beyond Polymarket. We have disclosed our evidence to affected parties, and the issue has been partially mitigated.