Polymarket Hit by Oracle Manipulation Attack: Can Big Players Use Voting Power to "Turn Black into White"?
TechFlow Selected TechFlow Selected
Polymarket Hit by Oracle Manipulation Attack: Can Big Players Use Voting Power to "Turn Black into White"?
Is 1+1=2? Whatever the big players say it equals, that's what it equals!
Navigating Web3 tides with focused insightsBy Azuma, Odaily Planet Daily
Last night, Polymarket, the prediction market platform that surged in popularity during the U.S. election, suffered the most severe oracle manipulation attack in its history. A prediction pool with over $7 million in wagers delivered an incorrect outcome determination, resulting in heavy losses for users who bet on the correct answer, while those who bet on the wrong outcome walked away with all the funds in the prize pool.
The disputed market was titled "Will Ukraine reach a rare earth deal with Trump before April?" In reality, no such agreement has been reached between the U.S. and Ukraine, meaning the correct outcome should have been "No." However, as shown in the image below, the market's outcome unexpectedly flipped to "Yes" just before settlement, ultimately creating this upside-down result.
Why did this happen? The answer lies in Polymarket’s resolution mechanism. Polymarket relies on the UMA oracle for event outcome resolution, following this process:
-
Result Reporting: After an event occurs, anyone can report the outcome to UMA.
-
Dispute Window: Once a report is submitted, there is a dispute period. Anyone who believes the report is incorrect may challenge it. If no disputes are raised, the reported result is accepted; if a dispute occurs, UMA’s dispute resolution system determines the final outcome.
-
Dispute Resolution: UMA token holders vote to determine the correct outcome. Honest participants are incentivized, while malicious actors are penalized.
According to Polymarket’s process records, this prediction market reached the third stage—meaning someone challenged the initial report, necessitating a UMA vote to determine the final outcome.
According to the final UMA voting results, 54.6% of votes ignored factual reality and selected "Yes," forcibly pushing the market to settle as "Yes."
As documented by Reddit user @iamtheone, early in the UMA voting process, the alternative option "It's too early to conclude" was leading. However, in the final phase, a mysterious force poured millions of UMA tokens into the "Yes" option, abruptly flipping the outcome.
Meanwhile, UMA’s price spiked 24% on March 22 without clear justification, then gradually declined—suggesting the orchestrator may have begun preparing days in advance.
The Reddit user added that this is not the first oracle manipulation incident on Polymarket. The platform has previously seen smaller-scale manipulations—such as falsely declaring Edmundo González as Venezuela’s president or claiming Trump audited Fort Knox. However, this case involves the largest sum yet, with total wagers exceeding $7 million.
The root cause of this incident lies in Polymarket’s reliance on UMA voting, which only imposes a 0.05% penalty for incorrect votes. This makes the cost of manipulation extremely low. Faced with potentially massive profits from altering outcomes, attackers have strong incentives to carry out oracle manipulation.
More shockingly, Polymarket officials announced early this morning on Discord that they were aware of the incident but could not issue refunds.
"We are aware of the anomaly in the Ukraine rare earth deal prediction market. The market’s settlement outcome contradicts user expectations and our prior clarifications. As this incident does not constitute a system failure, we are unable to process refunds. The current situation is unprecedented. We are holding emergency round-the-clock meetings with the UMA team to ensure this never happens again. This is not the future we want to build—we will establish more robust system monitoring, clearer rule frameworks, and faster clarification processes. Specific measures will be announced progressively after comprehensive evaluation."
Unsurprisingly, Polymarket’s response quickly drew fierce backlash from the community. The comment section under the original market now contains 5,554 comments, with many users criticizing both Polymarket’s mechanisms and its response.
As one of the most impressive projects in the crypto space last year, Polymarket clearly has sufficient funds to fully compensate affected users. Offering such a response risks severely damaging its market credibility and community goodwill. Given the intense community sentiment, whether there remains room for reconciliation remains to be seen. Odaily Planet Daily will continue to follow developments in real time.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
Odaily
