If you can't afford to lose, you will turn over the table. Polymarket is attacked by a large-scale governance

Author: Fairy, ChainCatcher

Edited by: TB, ChainCatcher

Last night, community users reported that a recent "wildest" governance attack occurred on Polymarket. In a market that is about to lose money, a large UMA player uses the last-minute voting weight to control the oracle, allowing the market to settle according to the results that have not happened in reality, and successfully turn the tables and make profits.

When the gambling rules become "if you can't afford to lose, change the answer", is this still a fair market?

A blatant "casino cheating"

The predicted market question involved in this incident is: "Will Ukraine agree to sign a mineral agreement with Trump by April?"

As of the time of market settlement, there was no official statement or decision to confirm that the agreement had been reached. On March 25, Trump said that he would sign the U.S.-U.S. mineral agreement "expectedly" soon, but in fact, the deal was neither officially signed nor announced to the public.

However, Polymarket finally ruled that the result was YES.

 Source: Polymarket

How is Polymarket governance attack implemented?

According to the disclosures of community users @Web3Marmot and @hermansen_folke, the governance attacks of Polymarket are mainly achieved through UMA oracle voting manipulation.

Polymarket relies on UMA's decentralized oracle to verify results. UMA has its own arbitration system to resolve disputes, and the arbitrators are real people—participants in the UMA ecosystem, especially UMA token holders. This system is called DVM (Data Verification Mechanism).

However, the UMA oracle's ruling power is concentrated in the hands of a very small number of "giant whales" holding large quantities of UMA tokens. According to community analysis, only two big players control more than 50% of the voting rights. They are not only voters, but also players on Polymarket.

According to @hermansen_folke's analysis, UMA is theoretically a neutral oracle, but in fact tends to "follow herd". In UMA oracle, voters need to stake tokens to vote, and if the vote is different from the choices of most people, they will lose these tokens. This means that voters do not necessarily choose the real result, but tend to follow big players who hold large tokens and have historically profitable profits.

In addition, to propose a market resolution of yes or no, a margin (usually US$750 USD) must be paid, and the same amount is also required to raise an objection. If the vote is detrimental to the challenger, they will lose this margin and even if they are correct, the final reward will be very few. This mechanism leads to a serious asymmetry: whales with large amounts of bets and UMA ticket rights can easily pay margins and control market rulings, while ordinary users are afraid to challenge because they are afraid of losing money.

In this incident, a large-scale UMA token holds a large number of UMA tokens tilts the results in their favor by manipulating the vote when the market is about to settle.

As can be seen from the figure below, the big account invested 5 million tokens through three accounts, accounting for 25% of the total votes.

 Source: betmoar.fun

Official response: acknowledge the ruling dispute but refuses to refund

Polymarket officially issued an announcement on Discord after the incident, acknowledging that the ruling results of the Ukrainian rare earth market are biased from user expectations and official clarification information, but since this is not a market system failure, the platform cannot provide a refund.

Polymarket said they had an emergency discussion with the UMA team and promised to strengthen system monitoring and improve rules to prevent similar situations from happening again. In the future, the adjudication mechanism will be further optimized to ensure clearer rules and clearer clarification processes will be more transparent and timely, and more details will be announced in the future.

The oracle should be a fair referee, but in the end it becomes a tool for capital manipulation.

Although Polymarket officially admitted that the ruling did not match the user's expectations, it refused to refund. This decision not only caused the affected users to suffer losses, but also caused the trust of the entire market to fall to freezing point.

When ordinary players find that even if they bet on the right direction, they will find it difficult to fight against the big players' one-click change, who can continue to act as a lamb in this controlled game?