JesterTheGoose@Jesterthegoose
I just went on a whole journey to figure out what this was. I checked the transaction on-chain, and the fee was not paid because of Polymarket, it was paid because of a builder code that @polymarket_O3O was using, which charged 0.1% fees ($5!).
I couldn't find any reference to the builder code online, but I tracked down all the trades that used that code. The code had made ~300 dollars over about 2 months. O3O had been using it for weeks, but not on every trade. When I reached out to O3O, they claimed they didn't use any terminals. When I sent them the list of the accounts that had used the code, they also said that another account that belonged to them was in the list.
I then reached out to any other traders using the code whose Twitter accounts were linked. One person responded, @GutsPoly said that they had traded directly on the Polymarket website for the trades where the chain showed they were using the code on.
I then directly asked O3O if they had any Polymarket-related extensions installed...
Turns out it's @securezer0's Chrome Extension, when I looked through the extension's code, I found that it was injecting its builder code. It did not appear to do anything suspicious. The fact that it charged 0.1% fees was not disclosed in the Chrome extension description.
I reached out directly to SecureZero, and they said they did add their builder code, but they refunded all of them. When I mentioned that it was not disclosed in the extension text, they were surprised and said that Chrome "rejected our extension upgrade where that was added" (to the description of the Chrome extension) and that they "did not mean to mislead".
For the record, I believe them; it was 300 dollars total in fees, there is no reason to do something over that much (and it was only 0.1%). They have since taken down the extension (or at least I can't access it at the URL anymore).
I mostly wanted to share this as both a warning (to be very careful what Chrome extensions you install). And because it was an interesting experience trying to find out what was causing this. I obviously do not think Chrome extensions should be charging fees without disclosing them (AND YOU SHOULD HAVE BEEN ABLE TO OPT-OUT OF THIS). But I do not think this was meant to be inherently malicious.
