Ghost-Filled Orders: Detecting and Testing Atomicity Violations in Non-Custodial Prediction Markets
Zhiyang Chen, Fan Long, Zhendong Su
cs.CR
2026-09-16
Toronto and ETH Zurich attributed 1.82M Polymarket reverts: user-controlled preconditions caused 97.2%, and 94% of timed invalidations avoided $61.3M in losses.
Non-custodial prediction markets keep the order book off-chain and settle fills in smart contracts. Traders hold their own wallets. That design creates an atomicity gap: an order can be valid when the off-chain book accepts or matches it, then invalid by the time the operator submits settlement. The community calls the result ghost-filled orders, trades that look filled in the UI and then revert on-chain.
The gap is a time-of-check to time-of-use window. After a match and before settlement, the maker can still bump a nonce, move collateral or outcome tokens, or revoke approvals. When new information arrives, a sports result or a five-minute BTC candle close, the order owner holds a one-sided option: let winning fills settle, invalidate the losers.
The University of Toronto and ETH Zurich split the work into analysis of historical reverts and a black-box audit of other markets.
On Polymarket they inspect five settlement contracts and nine settlement functions, extract every revert guard, and label operator-side predicates O1–O7 versus user-controlled U1–U6 (nonce, ERC-20/1155 allowance and balance, ERC-1155 receiver hooks). A detector replays each reverted settlement to find the failing leg. A probe then walks the responsible address backward to the transaction that flipped that predicate. The window runs from 12 August 2025 to 22 May 2026 and contains 1,824,926 reverted settlements.
The audit uses only ordinary trader privileges. Submit a small taker order through the public API, wait until the API reports a fill, then invalidate an on-chain precondition and measure how long that still works. The three extra markets stay unnamed for responsible disclosure.
Classification coverage is 100%. User-controlled predicates account for 1,774,655 reverts (97.2%), and probes recover the invalidating transaction for 96.6% of those. Mean invalidation cost is $0.0174. Mean latency of 2,558.7 Polygon blocks (about 1.2 hours) is dominated by stale tails. The attack-shaped mass sits at short latency: for ERC-20 balance failures, 46.2% of located invalidations share a block with settlement and 71.7% land within one block.
Case study 1 keeps 757,580 reverts whose invalidation sits within 60 seconds of market end or anytime after:
| Role / timing | Txns | Avoided loss | Forgone gain | Avoided-loss rate |
| Maker, at or before end | 133,026 | $2.79M | $0.21M | 85% |
| Taker, at or before end | 89,688 | $9.08M | $0.12M | 81% |
| Maker, after end | 299,604 | $10.85M | $0.04M | 99% |
| Taker, after end | 235,262 | $38.55M | $0.01M | 98% |
| Total | 757,580 | $61.28M | $0.38M | 94% |
The loss-to-gain ratio is 161:1. Four short-horizon crypto up/down books (BTC, ETH, SOL, XRP) hold 78% of avoided loss.
Case study 2 looks at mid-market book clearing. Among 64,604 revert clusters, 77% are at least 90% owned by a single address, and 63.88% produce a price spike or dip relative to neighboring windows. The paper cannot hard-link the clearing address to the market maker who then buys the leftover quotes.
All three audited markets are exploitable, and invalidating one order can fail other users' fills in the same batch. Only Market X, a sports book with up to 10 seconds of delay between off-chain fill and on-chain settlement, is also profitable: the API has already locked the order while on-chain balances remain under user control.
Self-custody is the product, and it is also the option. Polymarket v2 deposit wallets route cancel, approval, and transfer through the operator, which blocks some invalidations and discounts the original non-custodial claim. For market makers on short-horizon crypto and sports books, a match in the UI is no longer a fill.
The $61.28M figure is counterfactual avoided loss, not realized on-chain profit. Case study 2 never ties the clearer to the maker who captures the mispricing. The three extra venues stay anonymous. The threat model assumes an honest operator. ERC-1155 balance probes miss 47,026 attributions. Concurrent work by Shen et al. stresses realized profit and cross-chain reuse; this paper stresses predicate-level attribution and counterfactual P&L.