PaperlayerView exact revision on arXiv

Source-linked AI summary

Ghost-Filled Orders: Detecting and Testing Atomicity Violations in Non-Custodial Prediction Markets

Zhiyang Chen, Fan Long, Zhendong Su

arXiv:2609.17902v1cs.CR

TL;DR

Off-chain matching followed by later on-chain settlement leaves a gap in which matched orders can become invalid, raising questions about the scale and scope of ghost-filled orders. The paper analyzes Polymarket reverts and audits other markets, finding the same vulnerability in all three additional markets tested, with direct attacker profit possible in one.

  • Problem

    Non-custodial prediction markets can match orders off-chain before settlement on-chain, but the prevalence, impact, and exploitability of resulting ghost-filled orders remain questions for Polymarket and other markets.

    Source: §1 · p. 1

  • Method

    The paper formalizes ghost-filled orders as atomicity violations, analyzes Polymarket reverts and their causes, and applies a black-box audit procedure to other prediction markets.

    Source: §1 · p. 2, §6.1 · p. 12

  • Results

    All three additional markets tested were exploitable through the same class of invalidation, and one was directly profitable for potential attackers.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Ghost-filled orders are a broader design risk in non-custodial prediction markets, motivating stronger atomicity guarantees between matching and settlement.

    Source: §8 · p. 14

    The hook-code attack vector was theoretical in the studied setting because Polymarket automatically banned accounts that changed their account-contract hook code.

    Source: §5.1 · p. 7

Abstract

from arXiv · show

Blockchain based prediction markets combine offchain order management with onchain settlement. This architecture supports user controlled custody, since users keep funds in wallets or smart contracts while submitting signed orders to an offchain order book. However, it creates an atomicity gap. An order may be valid when accepted or matched offchain, but become invalid before the corresponding onchain settlement transaction is executed. This behavior, often called ghost filled orders by the community, can cause trades that appear filled offchain to fail onchain. This paper studies this atomicity gap through a case study of Polymarket. We show how the delay between offchain order acceptance and onchain settlement allows adversaries to invalidate unfavorable orders after observing market outcomes or price movements. We then quantify the scale and financial impact of this behavior over a nine-month period from August 12, 2025, to May 22, 2026, using 1.8 million reverted transactions involving Polymarket official smart contracts. Our analysis separates attacker profit from market and user loss, and develops conservative measurement rules to avoid overclaiming impact. We further develop a methodology for testing other blockchain based prediction markets and apply it to three additional markets. We find that all three are vulnerable to the same class of attack, and that one design enables direct attacker profit. We have reported the findings to all three projects; one project had acknowledged the issue at the time of the study.

1. Introduction

Non-custodial markets defer on-chain settlement after off-chain matching, leaving a window in which matched orders can become invalid. This paper formalizes and measures that atomicity gap in Polymarket and tests whether it affects other prediction markets.

1. Introduction

  • The off-chain/on-chain gap lets traders invalidate mutable settlement preconditions after matching, leaving ghost orders that can shape displayed prices but fail to execute.Around fast-moving information, owners can allow favorable orders to settle while invalidating unfavorable ones.Source: §1 · p. 1
  • The introduction frames open questions about invalidating actions, distinguishing malicious from benign failures, financial impact, and whether the problem extends beyond Polymarket.The paper notes that Polymarket had publicly acknowledged ghost-filled orders and announced urgent upgrades.Source: §1 · pp. 1–2
  • The study analyzes 1.8 million Polymarket reverts from August 12, 2025, to May 22, 2026, and finds strategically patterned invalidations and asymmetric effects in timing-sensitive markets.Patterns include concentration among a small number of markets and responsible parties, with invalidation within 0–2 blocks.Source: §1 · p. 2
  • The framework classifies all 1,824,926 Polymarket reverts and identifies order-invalidating transactions for 96.6% of user-controlled reverts.It classifies violated preconditions and backtracks the transactions that invalidated orders.Source: §1 · p. 2
  • Responsible parties avoided over 61M USD in losses, and a single responsible party dominated 77% of ghost-filled order clusters.The paper evaluates scenarios involving loss avoidance and potential profit from outcompeting other market makers.Source: §1 · p. 2
  • All three additional markets tested were exploitable through the same class of invalidation, and one was directly profitable for potential attackers.The findings were responsibly disclosed; one market acknowledged the vulnerability.Source: §1 · p. 2

2. Background

This background introduces prediction markets and the tokens and order-book roles needed to understand the later ghost-order mechanism.

2. Background

  • The background section establishes concepts needed to understand the paper’s treatment of non-custodial prediction markets.The paper uses “prediction market” to mean a non-custodial blockchain-based market unless otherwise specified.Source: §2 · p. 2

2.1. Prediction Markets

  • In this paper, prediction markets trade contracts tied to future events, while prices reflect participants’ aggregate estimates of outcome likelihood.The paper distinguishes custodial markets, which hold funds, from non-custodial markets, where trades settle through smart contracts and users retain control of funds until settlement.Source: §2.1 · p. 2

2.2. Collateral and Conditional Tokens

  • Polymarket collateral tokens purchase outcome shares represented as ERC-1155 conditional tokens; each binary event has Yes and No tokens that can be merged or split against collateral.Polymarket v1 uses USDC.e and v2 uses pUSD as collateral.Source: §2.2 · pp. 2–3

2.3. Order Book and Maker/Taker Orders

  • A central limit order book organizes maker liquidity for takers, with buy orders exchanging collateral for conditional tokens and sell orders exchanging conditional tokens for collateral.Source: §2.3 · p. 3

3. Ghost-Filled Orders

Ghost-filled orders arise because off-chain matching precedes on-chain settlement while required blockchain state remains mutable. Invalidating one order can also disrupt other matched orders bundled into the same settlement transaction.

3. Ghost-Filled Orders

  • A trader signs and submits an order to the off-chain CLOB, which marks it live or delayed and later matched; an authorized operator then submits on-chain settlement.Source: §3 · p. 3
  • The gap spans delays before matching, operator submission, and on-chain inclusion and finalization, during which required state is not locked.A trader can change nonce or move collateral or conditional tokens; if a required precondition is invalidated, settlement reverts and the matched trade is dropped.Source: §3 · p. 3
  • Around new outcome information or price movements, the order owner can let favorable fills settle while invalidating unfavorable ones, shifting execution risk to counterparties.When a settlement transaction bundles orders, one invalidated order can revert the entire transaction and prevent otherwise valid orders from settling.Source: §3 · p. 3

4. Problem Formulation

The section formulates two tasks: reconstructing why individual Polymarket settlement transactions revert and auditing prediction markets for ghost-filled-order feasibility and attacker incentives.

4.1. Preliminaries

  • Orders carry owner, role, side, token, price, amount, nonce, and expiry fields, while settlement transactions bundle orders in their fill sequence.The fill sequence can be recovered from emitted OrderFilled events in the replayed transaction trace.Source: §4.1 · p. 4
  • In Polymarket, signed orders cannot be edited in place; changing terms requires canceling the resting order and submitting a new payload.The signed payload binds core settlement terms including asset, side, price, and amount.Source: §4.1 · p. 4
  • A precondition is a Boolean predicate on blockchain states that must hold before execution for the associated execution to succeed.Settlement predicates subsume the validation predicates of bundled orders, and violating any one causes a revert.Source: §4.1 · p. 4
  • The failing leg identifies the first violated predicate in a reverted transaction and the party able to flip it from true to false.The responsible party is the address that can unilaterally change the failing predicate by submitting an invalidating transaction.Source: §4.1 · p. 4
  • An invalidating transaction precedes the revert and changes its failing predicate from satisfied to violated; failing latency measures the blocks between the two transactions.Invalidating cost is the gas consumed by the corresponding order-invalidating transaction.Source: §4.1 · p. 4

4.2. Threat Model

  • The threat model treats privileged operators as benign and considers a financially rational, non-privileged user who can observe pending transactions but cannot control block contents.The attacker interacts through the CLOB APIs and exchange contracts, and can influence transaction ordering through fees or block-building and relay services.Source: §4.2 · pp. 4–5

4.3. Targeted Problems

  • Transaction-level analysis reconstructs each reverted settlement’s failing predicate, responsible party, invalidating transaction, latency, cost, and associated gain or avoided loss.The analysis also considers realized profit when the responsible party is a trader.Source: §4.3 · p. 5
  • Systemic auditing tests whether an ordinary user can invalidate settlement and whether the adversary’s expected gain outweighs the attack cost.The audit characterizes both whether the attack can occur and how strongly the market incentivizes it.Source: §4.3 · p. 5

5. Analysis Framework and Results

The analysis classifies Polymarket settlement reverts by violated precondition, traces transactions that invalidate user-controlled conditions, and examines their timing and market effects. It reports that user-controlled conditions dominate, with near- and post-market reverts largely avoiding losses while some revert clusters clear order books and sharply disrupt prices, especially in crypto markets.

5. Analysis Framework and Results

  • The framework maps settlement revert guards to preconditions and responsible parties, then replays failures and probes prior transactions to identify the violated condition and its invalidating transaction.Its taxonomy distinguishes operator-side conditions, such as valid signatures and active orders, from user-controlled conditions: owners can increment a nonce to invalidate signed orders, while bundle overfills can make individually valid orders fail together. The nonce mechanism applies only to Polymarket v1; the receiver-hook attack vector is described as theoretical under the account-banning policy in force at the time.Source: §5 · p. 5, §5.1 · pp. 6–7

5.2. Analysis Setup and Scope

  • The dataset covers 1,824,926 reverted transactions invoking nine settlement functions across five Polymarket contracts from 2025-08-12 to 2026-05-22 UTC.The study analyzes these transactions to identify violated preconditions, responsible parties, and the earlier transactions that invalidated them.Source: §5 · p. 5, §5.2 · p. 8

5.3. Analysis Coverage, Invalidating Cost & Latency

  • The taxonomy covers all 1,824,926 reverts; user-controlled preconditions account for 97.2%, and probes attribute 96.6% of those cases to an invalidating transaction.Operator-side preconditions account for 2.8%. The overall average invalidating cost is 0.0174 USD per reverted settlement transaction.Source: §5.3 · pp. 8–9, Table 2 · p. 9
  • Average failing latency is 2,558.7 blocks, or about 1.2 hours, but 46.2% of located ERC-20 balance invalidations occur in the same block and 71.7% within one block.Long-tail stale-state cases skew the average; same- or next-block clusters are consistent with strategic invalidation near settlement, though the analysis also identifies stale orders, operational mistakes, and bugs as possible causes.Source: §5.3 · p. 9, Table 2 · p. 9

5.4. Case Study 1: Avoiding Losses After Market Closure

  • The study examines a “free look” strategy: an order owner can let a profitable trade settle but invalidate a precondition if the market outcome would make it unprofitable.The supplied passages introduce two suspicious scenarios and describe a BTC Up/Down five-minute market example, but do not provide their measured financial results.Source: §5.4 · p. 9, Table 3 · p. 10
  • Across 757,580 reverted transactions, 94% avoided losses and total avoided losses exceeded forgone gains 161:1; post-market rates reached 99% for makers and 98% for takers.Before market end, avoided-loss rates were 85% for makers and 81% for takers. The authors attribute the higher taker rates to more predictable settlement timing, which makes reverts easier to time.Source: §5.4 · p. 10
  • Four short-horizon crypto up/down markets accounted for 78% of total avoided losses: BTC ($17.0M), ETH ($11.3M), SOL ($9.9M), and XRP ($9.6M).Avoided losses were concentrated in 5-minute, 15-minute, and 4-hour crypto up/down markets.Source: §5.4 · p. 10

5.5. Case

  • In an active-market example, seven revert clusters were mostly dominated by one responsible party, while account 0x0c165 repeatedly bought DOWN tokens at low prices and later sold near market close.The top-party shares were 99.4%, 99.7%, 44.7%, 99.5%, 100.0%, 99.8%, and 91.4%. The proposed mechanism is that reverts remove resting maker orders, leaving stale quotes for a remaining maker to trade against before liquidity returns.Source: §5.5 · p. 11
  • In 49,567 of 64,604 revert clusters (77%), one address caused at least 90% of reverts, and 63.88% of clusters showed a price spike or dip.The analysis defined clusters as consecutive blocks with at least five reverts in the same market, merging clusters separated by two or fewer blocks; it compared prices across pre-, cluster-, and post-windows.Source: §5.5 · p. 11
  • Revert clusters also occurred outside crypto markets, including sports (2.39%), esports (2.00%), and politics (1.01%).Across the 10,017 clusters with matched orders in pre-, cluster-, and post-windows, the authors could not find a clear connection between responsible parties and the makers who profited.Source: §5.5 · p. 11

6. Auditing Procedure and Results

The audit tests whether ordinary users can invalidate settlement after an off-chain fill, separating damage to other orders from the longer post-fill window that can make attacks profitable. All three additional markets were exploitable, while only Market X was also profitable; the paper discusses defenses ranging from resource locking to atomic settlement.

6.1. Audit Methodology

  • The auditors used public market APIs and direct blockchain transactions, without privileged access or control of the matching engine.They measured the maximum successful delay by trying candidate delays after an API-reported fill and recording when settlement reverted.Source: §6 · p. 11, §6.1 · p. 12

6. Auditing Procedure and Results

  • The audit distinguishes any successful settlement invalidation, which violates Property 1, from a positive post-fill invalidation delay, which violates Property 2.Property 1 concerns effects on other users’ valid orders; Property 2 concerns whether on-chain invalidation remains possible after API cancellation is disabled.Source: §6 · pp. 11–12, §6.1 · p. 12

6.2. Audit Results

  • All three audited markets were exploitable, and invalidating one order could disrupt other users’ batched orders that were not reliably returned to the order book.Market Z acknowledged the vulnerability as a known gap.Source: §6.2 · p. 12, Table 4 · p. 12
  • Only Market X was both exploitable and profitable, with an up-to-10-second delay leaving users unable to cancel through the API but able to invalidate settlement on-chain.During the delay, users retained control of the assets and approvals needed for settlement, giving blockchain-aware users additional reaction time.Source: §6.2 · pp. 12–13

6.3. Defenses

  • Locking filled-order resources can prevent unilateral invalidation before settlement, but Polymarket’s v2 deposit-wallet design weakens the non-custodial promise and legacy v1 accounts may retain direct invalidation ability.The v2 design routes cancellations, approval changes, and token transfers through Polymarket.Source: §6.3 · p. 13
  • A market-operated blockchain can enforce atomic matching and settlement, satisfying both properties; a redesigned layer-2 sequencer is an alternative.The proposal places the needed checks in consensus or before block finalization.Source: §6.3 · p. 13
  • Monitoring, account bans, and transaction-ordering defenses can raise attacker costs or reduce timing control, but are only partial mitigations.Fresh wallets are inexpensive, and a fast attacker may act before detection and banning.Source: §6.3 · p. 13

7. Related Work

Prior work covers prediction-market behavior, blockchain transaction ordering, TOCTOU, and smart-contract security, but the cited prediction-market studies had not addressed security. This paper situates ghost-filled orders as an atomicity issue in prediction markets rather than a flaw in contract code itself.

Prediction Market

  • Prior Polymarket microstructure studies [27], [28] did not address security, while community reports described ghost-filled orders in different markets,.This paper empirically studies the issue at scale and analyzes its atomicity violation and financial impact.Source: §7 · p. 13

Blockchain MEV and Front-Running

  • Ghost-filled orders share technical grounds with MEV and front-running,,, including order-position control and invalidations likely included in settlement blocks.The paper applies that connection to prediction markets.Source: §7 · p. 13

TOCTOU and Race Conditions

  • The paper treats ghost-filled orders as a blockchain-market instance of TOCTOU,,, distinct from concurrent work focused on realized profits and cross-chain contract reuse [33].Its audits deliberately invalidate matched orders and measure the remaining post-API-cancellation window.Source: §7 · p. 13

Smart Contract Security

  • Unlike smart-contract security work,,, [37], this study targets system-design flaws in blockchain-based prediction markets rather than vulnerabilities in contract code.It also uses transaction tracing techniques similar to prior work,.Source: §7 · pp. 13–14

8. Conclusion

The paper formalizes ghost-filled orders, analyzes reverted settlements and their financial effects, and audits deployed markets. Its conclusion is that the issue is a broader design risk requiring stronger atomicity between matching and settlement.

8. Conclusion

  • Ghost-filled orders are a broader design risk: the study reports over 61M USD in avoided losses, frequent arbitrage-like opportunities, and vulnerabilities in multiple deployed markets.The paper concludes that stronger atomicity guarantees are needed between order matching and settlement.Source: §8 · p. 14

Related papers

Loading 2609.17902v1…