prraneetak π² retweetledi
On May 9, I found a bug that allowed anyone to post clarifications on-chain on the @Polymarket contract. I knew it would work because I have been using Polymarket contracts for a long time. The catch? It is not really a bug, but a feature in Polymarket’s contracts. The contracts state that “anyone can post an update for any questionID, but users should only consider updates posted by the question creator.” It was intended and built into an immutable contract 2 years ago. These messages were not appearing on the Polymarket UI or in their Discord channels. However, they were visible on @betmoardotfun’s UI and to people who track clarifications from on-chain data through bots or third-party tools. Betmoar is one of the top platforms used by Polymarket traders.
What actually happened on May 9?
I posted a clarification on-chain that was not posted by the Polymarket team, but by me. I wrote “Test message” and posted it on the Russia x Ukraine ceasefire market.
For context, this had nothing to do with any market-related action because the market had already been settled by the time I started testing it. My intention was to make everyone aware of this issue.
It definitely created some chaos, but it was done in good faith to bring attention to it before someone else could use it in the wrong way and cause huge losses in the future.
I reported it to the Betmoar team and they immediately fixed it. Huge thanks to them for acting quickly and making things better.
Three days later, exactly what I was worried about happened. Someone else used the same on-chain clarification feature to post what appears to be a fake clarification on the Epstein suicide note market.
Transaction: #eventlog" target="_blank" rel="nofollow noopener">polygonscan.com/tx/0x8560fbf1c…
The clarification stated:
“At the time of this clarification, there is now a consensus of credible reporting that the note released on May 6 was written by Epstein, including sources such as AP News: apnews.com/article/jeffre…”
This is exactly why I raised the issue earlier in good faith. My intention was not to create chaos, but to make people aware before someone could misuse it and potentially cause real losses.
The later incident caused around $20K in losses, as some people panic-sold their No shares, while someone else fast-clicked around 75,000 shares after receiving the on-chain clarification.
The losses could have been much higher if Betmoar had not removed/fixed the issue earlier, or if the chaos from three days before had not already made people aware of the risk.
Hopefully, this serves as a lesson for vibe-coded clarification bots and fast-clickers that rely on on-chain updates without properly verifying transaction signatures.
English
