I analyzed this a few days ago. Data in the image shows the latency distribution between offchain "fill" (and therefore websocket UI notification to traders) and the actual onchain fill, consistently 2-5 sec latency 2-5s is obviously more than enough time for traders to beat polymarket's onchain "match orders" tx by invalidating their order onchain faster and/or with higher gas to land earlier, making the order match tx impossible and fail So in practice how is this being "exploited"? Looking at the "How much spending will DOGE cut in 2025?" market that the attacker used, which is like 98% YES for the <$50b bucket and has 6 buckets: - (a) Negrisk bots hold/try to obtain NO shares in each bucket, accumulated at less than $5 per full set (1 NO share per bucket across all 6 buckets = $5 at resolution if exactly one bucket resolves YES, so if the NO shares cost you $4.90 total then you profit $0.10) - (b) These bots constantly monitor for opportunities to accumulate more of these full sets (NO shares across buckets at <$5 total) - (c) Which means they will place deep limit buy orders below market price on NO shares in certain buckets, looking to get filled at an undervalued price. For example, they may bid $0.5 on each of $50-100b and $100-150b NO, where the market ask for NO is $0.97-0.99 - (d) *This causes cases where they may be willing to overpay for shares*. Simplified example: - Say <$50b has NO shares priced at $0.02 ask, while NO shares in the other 5 buckets trade at $0.97-0.99 ask. - Negrisk bots place NO bids on these 5 buckets at deep discounts (say, $0.2-0.6) hoping for fills. - Say a bot gets a crazy good fill on the $50-100b bucket at $0.2; it is now able to lock in profit if it can buy a NO share in each remaining bucket while keeping the total set cost <$5. - The other 4 tails are $0.97-0.99; say the bot can buy all for $3.92 total. It has now paid $4.12. - It now just needs NO <$50b at max price $0.88 to be profitable, since the total cost for all NOs would still be under $5. So, it's willing to overpay for <$50b by a lot if needed - (e) Which becomes exploitable. How? What it looks like the attacker actually did here, in one case: - Attacker fill bot's NO bids for the $50-100b bucket at a huge mispricing, like $0.2 - Bot sees this "fill" via Polymarket's offchain data. This looks like a great fill, so it decides it can now buy <$50b NO for up to $0.88, since it would lock in profit - Attacker fills the bot's elevated <$50b NO bids, getting cheap YES shares - AND attacker cancels the $0.2 order in the $50-100b bucket before it is matched onchain - Attacker ends up with cheap YES shares in the <$50b bucket, and the bot ends up with NO shares in the <$50b bucket that it overpaid for WITHOUT receiving any of the mispriced $50-100b shares it thought that it would - (In practice, this is prob a gradual process where the attacker walks up the <$50b NO price, forcing bots to buy higher and higher and giving the attacker cheaper and cheaper YES entries. Works especially well in more illiquid books populated largely by negrisk bots) - (f) Attacker, in this market, ends up with 11,460 YES <$50b acquired at an avg of $0.12, when they're actually worth $0.98 Some conclusions: - Negrisk bots / MMs should be accounting for this; relying purely on polymarket's data (without tracking onchain matches) puts you at risk. I assume many already do, but obviously some did/do not. Bc of this I'm not sure I'd truly call this an "exploit", it's just how the system works rn - Polymarket can change this whenever by waiting to mark orders filled /notify users of fills offchain until the orders match onchain

not sure why the NYC token team has pulled $2.4m USDC from the LP (not including fees pulled, this is 2.4m purely $ from the LP) example tx (1 of 4)

$150k left in the LP lol

Lighter just created the LIT/USDC market, may be live soon

Flashblocks also explain why you see $jesse sniped in the "same block" that it was deployed - 38434332. The first sniper tipped $43.8k to buy 7.6% of the supply for $189k, then sold for over $850k Basescan doesn't explicitly show flashblocks, but you can fairly easily tell where the first flashblock after the token was deployed started by looking at the fees (see image) (Side-note: This was obviously a fee-game, but also a latency game, since getting into the very next flashblock where each is 200ms required you to react to the $jesse deploy tx fast enough Zora doesn't store any info about the # of coins deployed, or a mapping of recently deployed coins, onchain, so you had to directly react to the deploy tx rather than spamming a custom contract where you could've potentially landed in the *same* flashblock as the deploy)

Probably the most interesting thing I've read in months. Have been thinking a lot about novel ways to tokenize / trade attention lately, and I think this blog does a great job of describing one potential implementation in “attention perps” Which might sound stupid or infeasible at first glance, but there also were (and still are) a lot of issues to point out with prediction markets before they saw $10b valuations and parabolic volume growth. So maybe proper attention markets are at least worth thinking about Creating an "attention oracle" obviously comes with a lot of challenges, but I think that it could/should end up being a worthwhile product. Largely because, in a world where the abundance of information is only growing faster, attention will remain a scarce and valuable asset But why attempt to quantify and financialize it? Because demand is there and existing solutions have holes: - Indirect speculation on attention is growing. Meme stocks, trend coins like moodeng and chillguy, certain prediction markets, friendtech/time.fun, memecoin "deadfolios" of currently-dead-but-maybe-not-later things like macrohard / JFK files / roaringkitty, etc. - But these all have issues. Meme stocks aren’t pure attention, and memecoins aren’t great at truly pricing attention are plagued with other problems like constant start prices, bundlers, a relatively small userbase, and ever-changing fractured liquidity (chains, launchpads, vamps, etc) - Basically all of those issues would be solved by proper attention oracles perps (see image below) These wouldn't only unlock a new thing to trade (though that's certainly a draw, and finding edge in these markets would be fun), they'd also come with other advantages: - Ability to better quantify the memetic value (which is largely, though not fully, attention-driven) of assets where it plays a large role in valuation - Better human-facing products like tldr news feeds, content ranking systems, adaptive user interfaces, other things I haven't thought of - Improved "agent infrastructure" ^ On that last point: in a world of overly-abundant information, machines (like agents) need ways to identify what matters - especially as the # of them and the scope of their work grow. Attention oracles and markets could help agents decide what to consider in internal decisions or surface to users. These could become notable “infrastructure” to autonomous agents, giving them richer context that is currently hard to get across / quantify. This is somewhat speculative but imo worth considering All that said, the challenges in actually implementing attention oracles and markets are obviously steep. Some notable ones (out of the *many* present) that I see: - What input data to use (the article proposes prediction markets, which I very much agree with, but they're probably not the only input) - Transparently defining that input data while remaining robust against tampering. The entity that runs the oracle would likely need to be centralized and nimble to start - Potential licensing and IP-related issues - Limited scope. Even if starting markets were focused on celebrities, media, etc, there’s still a massive long tail of things that people would probably like to position in but would still (for now) only be able to get small exposure through markets like memecoins. Maybe this can be solved later, or maybe longer tail markets just aren’t a fit Overall, although "attention perps" may start out niche, gimmicky, and at least somewhat manipulatable, I think they could end up becoming much more than toys over time. Or they could end up never being robust enough to scale, who knows Creating novel liquid markets is probably the trend I'm interested in most right now. If there's any existing projects out there working on this, I'd love to talk to them (Final shoutout to multicoin for mentioning HIP-3 as a potential way to implement this. Hyperliquid)