Source-linked AI summary
The Ghosts of Polymarket: When Off-Chain Matches Meet On-Chain Reverts
Yiming Shen, Yuhan Jin, Shuohan Wu, Yanlin Wang, Jiachi Chen
TL;DR
Polymarket’s off-chain matching and on-chain settlement creates Ghost Fills when apparently completed orders later revert. GHOSTHUNTER reconstructs reverted settlements and attributes attacks, finding that 50.2% involved deliberate cancellation across four vectors and 35 variants.
Problem
Polymarket’s split execution leaves a window where orders appear filled off-chain although on-chain settlement remains pending or may revert.
Method
GHOSTHUNTER traces reverted matchOrders transactions, classifies failures, attributes attacker-caused cases with vector-specific rules, and detects reused designs across chains.
Results
50.2% of 1,952,440 Ghost Fills were attributed to attacks spanning four vectors and 35 implementation variants.
Takeaways & Limitations
The settlement gap enables deliberate order cancellation for profit and extends risk through reused contract designs across 167 deployments on 10 chains.
Takeaways & Limitations
The study does not fully quantify attacker profit or victim loss and is bounded to one venue, a limited time period, and verified open-source contracts.
Abstract
from arXiv · showhide
Polymarket has emerged as a prominent prediction market platform and one of the fastest-growing applications in DeFi. To achieve low-latency trading, it adopts a hybrid architecture that matches orders off-chain but settles them on-chain for final execution. This design creates a consistency gap we call Ghost Fills: an order that is successfully matched off-chain may later fail during on-chain settlement. To understand the security implications of this gap, we investigate such failed settlements by building GHOSTHUNTER, which reconstructs them from on-chain traces and attributes to concrete attack patterns. Across 1,952,440 reverted match-order transactions, we find that attackers exploit the time gap between matching and settlement to invalidate already matched orders before they are finalized on-chain. We then identify four attack vectors from these incidents: nonce bump, balance drain, allowance revoke, and proxy trap, realized via 35 evolving variants. These vectors allow attackers to selectively revert 980,133 filled orders, enabling risk-free prediction, arbitrage-bot hunting, and liquidity reward manipulation, realizing at least \$1.49M in profit, which places \$1.78 B USD at risk and 2.17 M POL (about \$212 K) paid by operator. During peak hours, more than 24.3% of all filled orders reverted, causing de facto DoS attacks. We also find that code derived from the flawed contract still appears in 167 independent contracts across 10 chains holding at least \$23 M in user funds, extending the impact beyond Polymarket. We have disclosed our evidence to affected parties, and the issue has been partially mitigated.
1. Introduction
Ghost Fills arise when Polymarket orders matched off-chain later fail during on-chain settlement, creating a costly security failure in its hybrid architecture. GHOSTHUNTER measures their prevalence and impact, attributes many failures to Cancellation Attacks, and finds that the risk propagates through reused contracts.
- Problem: Off-chain fills can remain pending or revert on-chain, although users, AI agents, and trading bots may treat them as completed trades.This consistency gap is the paper’s central problem: the UI or CLOB API can expose a fill before settlement is finalized.
- Prevalence and cost: 1,952,440 reverted matchOrders transactions involved 233,887 participants, affected $1.78 B of collateral, and burned 2.35 M POL in operator gas.The failures peaked at 8.5% of all settlements and were dominated by empty collateral balances and rejected token-delivery callbacks.
- Attacker impact: $1.49 M in realized profit came from exploiting Ghost Fills for risk-free prediction, arbitrage-bot hunting, and liquidity-reward manipulation.The estimate is likely conservative because some companion addresses could not be linked with confidence, and the activities were concentrated among a small number of adversaries acting at scale.
- Attack mechanisms: 980,133 reverts were attributed to Cancellation Attacks spanning four vectors: nonce bumping, balance draining, allowance revocation, and proxy traps.GHOSTHUNTER is a trace-based analysis engine that catalogs 35 implementation variants across these vectors.
- Ecosystem spread: 167 reused contracts across 10 chains show that Ghost Fill risk extends beyond Polymarket through contract reuse.The authors disclosed their evidence to affected third parties and released artifacts for reproducing the measurements.
2. Background
Polymarket combines off-chain order matching with on-chain settlement, creating a window in which matched orders can be invalidated before final execution. This settlement gap enables Cancellation Attacks that manufacture Ghost Fills by forcing matched trades to revert.
- Hybrid architecture and order lifecycle: Polymarket matches orders off-chain in a central limit order book and queues the reported fills for on-chain settlement on Polygon.Users sign orders off-chain; the CLOB checks signature, balance, and allowance before matching crossing orders and reporting the fill immediately.
- Outcome tokens: Settlement transfers ERC1155 outcome tokens minted by the Conditional Tokens Framework, with binary markets using YES and NO tokens.Winning tokens redeem one-for-one against collateral after resolution through the UMA optimistic oracle; NegRisk markets use a separate exchange contract.
- Accounts and order signing: Polymarket is noncustodial: users retain control of funds through EOAs or smart-contract wallets, while makers own order assets and signers authorize orders.The signer may be the maker or a delegate authorized to act for it.
- Transactions, contracts, and settlement requirements: On-chain settlement is atomic and rechecks nonce, asset balance, allowance, and ERC1155 recipient acceptance against current state.If any step reverts, the entire transaction rolls back and no state change persists; the operator pays gas for Polymarket Exchange settlements.
- Ghost Fills and Cancellation Attacks: A Ghost Fill occurs when the CLOB reports an off-chain fill but settlement reverts, whereas a Cancellation Attack deliberately invalidates the matched order during the settlement window.An attacker can mutate its own on-chain state after matching and before settlement to force the transaction to revert.
3. Threat Model
The threat model treats the attacker as an ordinary Polymarket participant who exploits the interval between off-chain matching and on-chain settlement. Attackers can manipulate controlled accounts, transaction ordering, and account identity to cause pending settlements to revert for strategic or disruptive purposes.
- Participants: The attacker is an ordinary market participant, while makers own collateral, signers authorize orders, and operators submit matched orders on-chain.The signer may be the maker or a delegate key, and Polymarket operates multiple operator accounts for throughput.
- Adversary Capabilities: Between off-chain match reporting and on-chain settlement, the adversary can act on controlled accounts to make pending matchOrders transactions revert.The adversary may outbid the pending settlement transaction with a higher gas price.
- Adversary Capabilities: The adversary can use many unlinkable accounts to form a Sybil cluster whose addresses appear unrelated on-chain.This capability helps the adversary continue operating despite possible blacklisting of abusive addresses.
- Adversary Objectives: Cancellations can capture favorable matches, harm AI agents and arbitrage bots acting before settlement confirmation, or degrade settlement availability into a platform DoS.The three purposes are respectively favorable-outcome selection, interference with downstream participants, and repeated cancellation.
- Scope: The study measures two Polymarket protocol generations across six contracts; V1 uses USDC.e, per-maker nonces, and Fee Modules wrapping underlying Exchanges.The platform-wide cutover to V2 occurred on Apr 28, 2026.
4. GHOSTHUNTER
GHOSTHUNTER reconstructs reverted Polymarket matchOrders settlements from on-chain calldata and execution traces, then applies evidence-based heuristic rules to attribute attacker-caused failures. It identifies four attack vectors and finds Polymarket-like exchange designs reused in 167 contracts across 10 chains.
- GHOSTHUNTER: GHOSTHUNTER decodes orders and settlement context, parses internal calls and revert reasons, and represents transaction and nearby causal evidence as relational facts.Its rules use skeleton, frame, and causal evidence to explain whether a participant-controlled action caused settlement failure.
- GHOSTHUNTER: Each attack rule first checks vector-consistent revert conditions, then requires causal evidence that a participant-controlled action preceded settlement when applicable.Rules were constructed through iterative snowball sampling because no ground-truth Cancellation Attack dataset exists.
- Attack vectors: Four attack vectors are encoded as heuristic rules: nonce bump, balance drain, allowance revoke, and proxy trap.Nonce bumps invalidate signed orders; balance drains remove collateral; allowance revokes reduce spending permission; proxy traps reject ERC1155 token delivery.
- Attack vectors: Proxy traps require no separate causal transaction because a participant wallet’s ERC1155 receiver callback rejects token delivery on every settlement attempt.The callback failure may appear as a direct revert, out-of-gas error from deliberate gas burning, or stack overflow from forced recursion.
- Cross-chain reuse: 167 contracts across 10 chains were confirmed to implement Polymarket-like hybrid exchange designs after filtering coincidental selector overlap.The cross-chain analysis used Sourcify’s verified-source dataset and identified operating entities and total value locked when available.
5. Answer to RQ1: Prevalence of Ghost Fills
Ghost Fills are widespread, with nearly two million reverted settlements affecting hundreds of thousands of participants and peaking at 8.5% of matchOrders transactions. They expose substantial collateral and operator gas, while failure patterns shift across the V1-to-V2 cutover rather than disappearing.
- Prevalence: 1,952,440 reverted settlements involved 233,887 participants, establishing Ghost Fills as widespread across the study window.V1 accounted for 1,090,016 reverts and V2 for 862,423.
- Temporal and version trends: 862,423 Ghost Fills occurred in V2’s first week, nearly matching V1’s 1,090,016 over nine months at comparable daily settlement volume.V2’s daily revert rate was more than an order of magnitude above V1’s.
- Temporal and version trends: 8.5% of all matchOrders transactions reverted on the worst day, after reverts increased by more than two orders of magnitude from early 2026.The Deposit Wallet upgrade reduced the daily rate from roughly 8% to 0.3% within two days, but the residual rate remained above the 2025 baseline.
- Failure surfaces: 51.1% of reverts arose from insufficient balances and 40.6% from rejected ERC1155 receiver callbacks, the two dominant failure surfaces.Insufficient allowance accounted for 3.5%, while the dominant surface shifted from Balance under V1 to ERC1155 callbacks under V2.
- Financial impact: $1.78 B of collateral failed to settle on-chain, while reverted settlements consumed 2.35 M POL, about $230 K, in operator gas.The collateral distribution was heavy-tailed: the median revert risked $11 and the 90th percentile $505.
6. Answer to RQ2: Cancellation Attack Vectors
GHOSTHUNTER attributes 980,133 of 1,952,440 Ghost Fills to deliberate cancellation attacks across four vectors: proxy trap, nonce bump, balance drain, and allowance revoke. These attacks evolved through 35 implementation variants and Sybil tactics, while some remaining reverts stem from platform-side bugs.
- Proxy trap: 790,913 proxy-trap reverts make it the dominant vector, using receiver-callback failures that prevent outcome-token delivery and revert settlement.It affects both roles, with 486,228 maker-side and 304,684 taker-side reverts.
- Proxy trap: 29 proxy-trap implementations evolve from gas burns and stack overflows to disguised benign errors and an EIP-7702 variant targeting a plain EOA.The newest carrier evades detectors that inspect only contract wallets.
- Nonce bump: 25,003 nonce-bump reverts arise when V1 signers call incrementNonce(), while V2 removes the function; attackers later hide the call inside internal transactions.Nonce bump over-indexes on NegRisk markets at 23% of its reverts against a 9.4% platform baseline.
- Balance drain and allowance revoke: 136,879 balance-drain reverts and 27,338 allowance-revoke reverts exploit front-running races that empty collateral or reduce exchange allowances before settlement.Balance drain is overwhelmingly taker-initiated at 91%, whereas allowance revoke is most often maker-initiated at 64%.
- Evasion and limitations: Attackers combine technical escalation with tens of thousands of throwaway addresses, while 21,076 V2 fee-computation reverts and other recurring failures are platform-side bugs rather than attacks.The reported platform-side failures include a faulty V2 fee check, NegRisk out-of-gas settlements, and a same-block balance TOCTOU race.
- Cancellation vectors: 980,133 of 1,952,440 Ghost Fills are attributed to four cancellation vectors: proxy trap, nonce bump, balance drain, and allowance revoke.The vectors exploit participant-controlled state changed after off-chain matching but before on-chain settlement.
7. Answer to RQ3: Spread of Risk
The flawed hybrid exchange design is widely reused beyond Polymarket, with 167 independent deployments across 10 chains holding at least $23 M in user funds. Prediction-market incentives can turn its tolerated settlement gap into an exploitable cancellation vector, although exploitation remains latent on smaller forks.
- Reuse and exposure: 31,897 verified contracts across 401 chains share at least one function selector with a Polymarket contract, while 96% have Jaccard similarity below 0.2.After filtering for meaningful similarity, testnets, duplicates, and Polymarket-owned addresses, 494 contracts reached Jaccard 0.5 or higher before the final manual inspection.
- Observed Ghost Fills: Three active prediction-market reuses still show Ghost Fills, with observed daily revert rates of 0.2% for P***n and roughly 1.0% for L***s.P***n’s ERC-4337 smart-account model mitigates the main cancellation vectors, whereas L***s reproduces Polymarket’s structure more closely and also shows an out-of-gas failure.
- Reuse and exposure: 167 independent reuses across 10 chains hold at least $23 M in user funds, including 71 byte-identical interface copies.These deployments are concentrated on Base and BSC, and the reuse count is a lower bound because the search covers only verified source code.
- Economic semantics: Prediction-market outcome information can make a matched order’s expected value negative before settlement, creating a direct incentive to cancel.The same Wyvern-style settlement gap was generally tolerated in NFT markets because price movements were smaller and more symmetric.
- Economic semantics: The risk is latent rather than absent on Polymarket-like forks because they lack Polymarket’s liquidity, trading frequency, and per-match rewards needed to make cancellation profitable at scale.If these deployments grow into the same incentive regime, the inherited cancellation vectors can activate.
8. Discussion
The discussion shows that Ghost Fills support multiple profit strategies, are coordinated through large-scale wallet operations, and remain exploitable despite partial mitigation. It recommends shrinking or closing the match-to-settlement gap while treating off-chain fills as provisional.
- Attacker Profit Strategies: $1.49 M across 4,940 profit addresses is the minimum realized profit attributable to attackers.The paper notes that this total understates the true haul because profits may be collected through addresses not directly linked to cancellation attacks.
- Attacker Profit Strategies: One address realized $15,904 from 360 orders, with 286 of 287 settled positions winning (99.7%) through risk-free prediction.The strategy cancels losing fills after resolution while allowing winning positions to settle.
- Attacker Profit Strategies: $13,397.65 in liquidity rewards flowed to 1,567 attacker addresses that canceled reward-eligible quotes after matching.This manipulation earns rewards without taking real inventory risk.
- Attacker Coordination: 46,389 distinct addresses conducted Cancellation Attacks, while 65.6% canceled only once before going dormant.Address association indicates that these wallets were controlled at scale; one funder seeded 24,539 fresh wallets in five days.
- Mitigation and Recommendations: Polymarket’s V2 cutover removed incrementNonce(), but the other attack vectors remained and cancellation attacks spiked during the following week.The later Deposit Wallet routes collateral through a platform-controlled wallet and revokes participant authority before settlement.
- Mitigation and Recommendations: Bots and AI agents should treat CLOB fills as provisional and confirm matchOrders on-chain before building on them.Platform-side remedies include escrowing collateral at order placement and reserving it against open orders to reduce the TOCTOU gap.
9. Threats to Validity
The study’s validity is bounded by conservative detection criteria that produce lower-bound attack counts and by incomplete observability of attacker intent, private order flow, and Sybil identities. Public orderbook snapshots also miss some canceled fills, limiting profit and victim-loss quantification.
- Internal Validity: Internal validity: GHOSTHUNTER’s conservative five-block and elevated-gas criteria make per-vector Cancellation Attack counts lower bounds.A causal transfer is flagged only within five blocks of the match and when the gas ratio exceeds one; the window approximates the roughly five-second matching-to-settlement gap.
- External Validity: External validity: attacker profit and victim loss remain incompletely quantified because intent, private CLOB flow, and links across Sybil addresses are unavailable.Public orderbook feeds are sparse resting-quote snapshots and miss some fills canceled by Ghost Fills.
10. Related Work
Prior work studies Polymarket arbitrage and market-data reconstruction, while broader research examines MEV, front-running, and contract-layer vulnerabilities. This work builds on those strands by situating failed on-chain settlements within prediction-market security.
- Prediction-market research: Polymarket research estimates roughly $40M in arbitrage profit and documents shrinking arbitrage inefficiencies as markets mature.Saguillo et al. distinguish market-rebalancing from combinatorial arbitrage, while Tsang et al. report inefficiencies declining from hours to under a minute.
- MEV and front-running: MEV research shows that transaction ordering enables front-running and classifies Ethereum attacks into displacement, insertion, and suppression.Related defensive work systematizes thirty MEV countermeasures and studies deployed auction-based solutions.
- Smart-contract analysis: Security-analysis tools detect exploitable frontrunning and state-inconsistency bugs using hybrid flow analysis, symbolic execution, and lightweight exploration.Nyx validates profitable victim front-running, while SAILFISH flags forty-seven vulnerable contracts on Etherscan.
11. Conclusion
GHOSTHUNTER shows that Polymarket’s Ghost Fills include deliberate Cancellation Attacks, in which actors force already matched orders to revert on-chain. It attributes half of the labeled reverts to attacks spanning four vectors and 35 evolving variants, generating substantial attacker profit and operator gas costs.
- Conclusion: 1,952,440 Ghost Fills were labeled on Polymarket, revealing deliberate Cancellation Attacks that void already matched orders by forcing on-chain settlement to revert.The attacks exploit the gap between off-chain matching and on-chain settlement.
- Conclusion: 980,133 reverts (50.2%) were attributed to Cancellation Attacks spanning four vectors and 35 variants that evolved against Polymarket’s defenses.The identified vectors are nonce bump, balance drain, allowance revoke, and proxy trap.
- Conclusion: At least $2.95M in profit was returned to attackers, while more than $212 K) of operator gas was burned.The passage reports these costs as consequences of the attack activity.
Ethical Considerations
The study uses only public on-chain and accessible Polymarket API data, avoids identifying users, and analyzes existing attacks without creating or executing them. The authors disclosed findings to Polymarket and attempted to contact affected third-party deployers.
- Data and privacy: The analysis uses public blockchain records and accessible Polymarket CLOB API data, without private user data, off-chain order-book snapshots, or proprietary systems.Blockchain addresses are treated as pseudonymous ledger identifiers, with no attempt to link them to real-world identities.
- Responsible analysis: The researchers did not create, deploy, or execute attacks, and GHOSTHUNTER operates only on historical data without interacting with live contracts or pending transactions.The documented cancellation vectors were already exploited in the wild before the study.
- Disclosure: The authors disclosed their findings to Polymarket and attempted to contact third-party deployers whose contracts reuse the vulnerable exchange design.The identified entity identities were also redacted.
Appendix A. Implementation Details of GHOSTHUNTER … Appendix D. BigQuery Queries
The appendices detail GHOSTHUNTER’s transaction-replay and rule-based classification pipeline, characterize cancellation vectors and variants, trace organized attacker funding, and provide BigQuery queries for dataset collection and cross-chain code-reuse analysis.
- Appendix A. Implementation Details of GHOSTHUNTER: GHOSTHUNTER replays each reverted matchOrders transaction, decodes revert payloads, and reconstructs internal call traces and state differences.The implementation uses Python, batched eth calls against an archive node, and official contract-source selectors.
- Appendix B. Cancellation Attack Measurements: Cancellation measurements report reverted settlements by V1 and V2, distinct attacker addresses, collateral at risk, and NegRisk-market revert shares.These measurements are summarized per vector in Table 4.
- Appendix B. Cancellation Attack Measurements: The classifier applies priority-ordered vector rules, probing causal facts before emitting a labeled Ghost Fill record or UNCLASSIFIED.Algorithm 1 orders rules as proxy trap > nonce bump > allowance revoke > balance drain.
- Appendix B. Cancellation Attack Measurements: The four cancellation vectors comprise 35 implementation variants, with Proxy Trap variants grouped by malicious fallback handlers, swapped proxy singletons, or direct contracts and delegated EOAs.The other vectors are distinguished by how the cancelling action is delivered.
- Appendix C. Organized Exploitation: A documented attacker cluster uses a funding hub to seed throwaway wallets and reclaim unspent gas change, preventing any wallet from retaining a balance useful for clustering.Figure 9 describes this peel-chain laundering pattern as forwarding one cancellation’s worth of gas per wallet.
- Appendix D. BigQuery Queries: Listing 1 collects reverted matchOrders transactions for V1, while the V2 query changes the contract-address set and time window and filters by the matchOrders selector.The collection query uses Polygon mainnet data and a specified block-timestamp range.
- Appendix D. BigQuery Queries: Listing 2 computes per-reference selector-set Jaccard similarity for cross-chain reuse analysis against four reference Polymarket exchanges.The query reports maximum Jaccard similarity and best overlap count after joining Sourcify contract compilations and signatures.