polymarket-nonce-guard - Detect and defend against the nonce race exploit o

项目说明

!Python !Polygon !License

Polymarket Nonce Guard 🛡️

Detect and defend against the nonce race exploit on Polymarket's CTF Exchange.

The Exploit

Exploiters on Polymarket call incrementNonce() on the CTF Exchange contract to in their losing orders before the operator can settle them. This means:

They place bets on both sides of a market

When the outcome becomes clear, they cancel the losing side via incrementNonce()

The winning side settles normally → risk-free profit

You end up holding shares that were supposed to be matched but ne ("ghost fills")

First publicly disclosed Feb 19, 2026 by on X.

Tools

nonce_monitor.py — Real-time incrementNonce watcher

Polls Polygon blocks every 2s, filters for incrementNonce() calls (method sig 0x627cdcb9) to the CTF Exchange. Logs every event with timing relative to BTC 5-min market windows.

Output: data/nonce_events.jsonl — append-only log of every detected call with caller address, tx hash, block, gas price, and market window timing.

blacklist.py — Exploiter address database

Loads known exploiter addresses from nonce_events.jsonl + a manual data/blacklist_manual.txt. Auto-refreshes every 60s.

counterparty_checker.py — On-chain fill analysis

Given a transaction hash, parses CTF Exchange logs to extract maker/taker addresses from settled orders.

manipulation_detector.py — Orderbook anomaly detector

Monitors Polymarket orderbook for suspicious patterns (large orders appearing/disappearing, price manipulation around settlement windows).

Setup

Requires a Polygon RPC endpoint. Default:

Configuration

Set these en or edit the constants at the top of each file:

CTF_EXCHANGE — CTF Exchange contract address (default: 0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E)

Polygon RPC URLs are hardcoded with fallbacks

Data

All output goes to data/:

nonce_events.jsonl — incrementNonce event log

manipulation_alerts.jsonl — orderbook anomaly alerts

blacklist_manual.txt — manually added addresses (one per line)

How to Defend Your Bot

1. Run nonce_monitor.py alongside your trading bot to build a blacklist
2. After each fill, use counterparty_checker.py to identify who you traded with
3. If blacklisted, immediately sell your position (take small spread loss ghost fill loss)
4. Report repeat offenders to Polymarket with on-chain e — they have CFTC regulatory pressure to act

Key Insight

incrementNonce() is a nuclear option — it in ALL pending orders from the caller's address, not just one. The CLOB API's cancel endpoint is surgical (cancels specific orders). Exploiters who use incrementNonce are leaving clear on-chain fingerprints.

License

MIT

项目信息

开发语言：Python

Star 数：62

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Detect and defend against the nonce race exploit on Polymarket's CTF Exchange展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。