WatchC26.6

Watch. Polymarket's CTF Exchange V2 (April 2026 upgrade) is gated by a custom timelock contract on Polygon at 0x47EbFAC3353314C788B96CDCbf41daadfE03629C with a 12-hour minimum delay verified via the initialization transaction. The contract's non-standard ABI does not expose the OpenZeppelin getMinDelay()/delay()/MIN_DELAY() selectors, so the data pipeline cannot auto-read the value; this sidecar carries the manually-verified delay until PD-042 (governance-fetcher extension) lands. Multisig admin is a 3-of-6 Safe (Protocol Admin, also the timelock's sole proposer/executor/canceller).

Polymarket

prediction_market · Polygon

TVL $514.2M

Sector prediction_market

Last assessed May 12, 2026

Critical findings 1 of 20

Risk score 26.6 / 100

Severity (R / Y / G) 11 · 43 · 64

Multisig 3/6 Protocol Admin

Timelock 12h custom timelock contract

Polymarket

Polymarket is the world's largest prediction market platform, operating on Polygon. Users trade binary YES/NO outcome tokens (ERC-1155) on real-world events. Architecture: off-chain CLOB + on-chain settlement via Gnosis Conditional Tokens Framework + UMA Optimistic Oracle resolution. Collateral is pUSD (backed 1:1 by USDC). Operated by Blockratize, Inc. (Delaware). V2 upgrade deployed 2026-04-28.

Sector prediction_market

TVL $514.2M

Reviewed May 12, 2026

Factors 184

Categories 13

Risk score 26.6

DeploymentsPolygon · $514.2M

Risk profile at a glance

0 red · 5 yellow · 7 green

25 24 17 13 15 22 16 10 13 12 8 5 4

Categories & evidence

184 factors · 13 categories

Code & audits Green 14 25 of 25

RD-F-009 red Formal verification coverage No formal verification coverage found. No Certora, Kani, Halmos, or equivalent FV specifications in any Polymarket repository. ChainSecurity/Cantina/Quantstamp audits are manual code assessments only. RD-F-001 yellow Audit scope mismatch CTF Exchange V2 audited March 2026 (Cantina + Quantstamp); post-audit commits exist through April 13, 2026 before April 28, 2026 deployment. No signed release tag links audit commit SHA to deployed bytecode. Post-audit commits appear non-logic-critical (docs only); Solidity bumped 0.8.33 to 0.8.34 during audit window. CTF Exchange V1 had post-audit ERC-1271 logic addition (October 2025) after ChainSecurity 2022 audit — V1 now sunset. RD-F-003 yellow Resolved-without-proof findings ChainSecurity audit summaries state 'high level of security' with no unresolved high/critical findings. V2 post-audit commits (March-April 2026) describe validation improvements consistent with audit remediation. Cannot verify specific finding-to-fix mapping without PDF access (binary PDFs). Confidence low. RD-F-014 yellow Reentrancy guard on external-calling functions CTF Exchange V1 (0x4bFb41d5...): nonReentrant guards present on fillOrder and matchOrders. CTF Exchange V2: reentrancy guard was removed per design — operator-only access model eliminates reentrancy vectors. The design rationale is sound but the absence of nonReentrant in V2 on ERC-1155 callback paths is a departure that warrants yellow. RD-F-015 yellow ERC-777/1155/721 hook without reentrancy guard CTFExchange V2 inherits ERC1155TokenReceiver and processes ERC-1155 callbacks. The V2 nonReentrant removal (see F014) means ERC-1155 callback paths are not guarded. However, only operators can initiate order matching, limiting attack surface. Cantina/Quantstamp audits reviewed and accepted this design. RD-F-024 yellow Code complexity vs audit coverage V2 is a modular mixin architecture (~12 mixin files). Two audit firms (Cantina + Quantstamp) both reviewed V2 in March 2026. Audit duration not determinable from PDF (binary). The parallel two-firm audit approach mitigates single-firm coverage gaps. Marking yellow due to inability to verify LOC/audit-day ratio. RD-F-183 yellow Bug bounty scope gap on highest-TVL contracts Cantina $5M bounty covers 18 contracts including V1/V2 exchange, NegRisk, pUSD, UMA adapter. The ConditionalTokens contract (Gnosis CTF, 0x4D97DCd9...) bounty coverage status in the Cantina program is uncertain — it is a Gnosis-deployed contract, not a Polymarket-deployed contract. The legacy Immunefi program explicitly listed ConditionalTokens as in-scope, but transition to Cantina program's exact scope for this contract is unverified. Possible gap during transition period. RD-F-010 gray Static-analyzer high-severity count No published Slither/Mythril/Semgrep run results found. Cannot run tools locally. Source inspection suggests low reentrancy risk in V2 (operator-gated) and clean V1 (nonReentrant guards). Requires tool execution for definitive assessment. RD-F-016 gray Divide-before-multiply pattern No published Slither divide-before-multiply output available. Cannot assess without tool execution. V2 fee math appears simple (constant MAX_FEE_RATE = 1000 bps) but full arithmetic path not verified. RD-F-018 gray Signed/unsigned arithmetic confusion No published symbolic execution results. V1/V2 use Solidity 0.8.x with built-in overflow protection. Cannot assess signed/unsigned confusion without tool execution.

RD-F-002 green Audit recency CTF Exchange V2 audited March 2026, deployed April 2026 — within 31-59 days. ConditionalTokens (CTF) audited by ChainSecurity April 2024. NegRiskAdapter audited ChainSecurity April 2024. UMA CTF Adapter audited OpenZeppelin (date unconfirmed).

RD-F-004 green Audit count 3 distinct audit firms cover the protocol stack: ChainSecurity (CTF, NegRiskAdapter, Exchange V1), Cantina (V2 exchange), Quantstamp (V2 exchange), OpenZeppelin (UMA CTF Adapter). Core V2 exchange has 2 simultaneous firms (Cantina + Quantstamp).

RD-F-005 green Audit firm tier Cantina (Tier-1, Spearbit-affiliated), OpenZeppelin (Tier-1) cover critical components. ChainSecurity (Tier-2), Quantstamp (Tier-2) also engaged. At least one Tier-1 firm on deployed code.

RD-F-006 green Audit-to-deploy gap CTF Exchange V2: audited March 2026, deployed on-chain 2026-03-31 — gap ≤31 days (within 60-day green threshold). V1 deployed post-audit within reasonable window in 2022.

RD-F-007 green Bug bounty presence & max payout Active Cantina bug bounty ($5M max, critical = $5M, high = $500K) covers 18 contracts including all CTF Exchange V1/V2, NegRisk, pUSD, and UMA adapter contracts. Legacy Immunefi program ($1M max) also existed. $5M is well above the $500K green threshold.

RD-F-008 green Ignored bounty disclosure No evidence of ignored bounty disclosure. The Trust Security 2025 disclosure about prepareCondition() frontrunning was disclosed responsibly through Immunefi with no evidence of prior-ignored disclosure. No smart-contract exploits on record (Rekt leaderboard empty).

RD-F-011 green SELFDESTRUCT reachable from non-admin path Source inspection of all reviewed CTF Exchange V1/V2 mixins (Auth, Pausable, Trading, AssetOperations, Assets, Fees, Registry, Signatures, Hashing, ERC1155TokenReceiver) found no SELFDESTRUCT opcode. ConditionalTokens (Gnosis CTF, 0.5.10) contains no selfdestruct per its design.

RD-F-012 green delegatecall with user-controlled target No user-controlled delegatecall identified across reviewed V1/V2 mixin source. pUSD UUPS proxy has _authorizeUpgrade restricted to owner. No arbitrary delegatecall path found.

RD-F-013 green Arbitrary call with user-controlled target No arbitrary user-controlled external call found. Exchange contracts call pre-specified immutable addresses (CTF contract, collateral ERC-20). No generic .call(user-supplied-address, data) pattern detected in reviewed source.

RD-F-017 green Mixed-decimals math without explicit scaling Exchange operates on single collateral token (pUSD, 6 decimals) and ERC-1155 outcome tokens all denominated in pUSD units. No multi-token decimal arithmetic identified. Low risk surface.

RD-F-019 green ecrecover zero-address return unchecked CTF Exchange V1 uses OpenZeppelin ECDSA.recover() (handles zero-address case). CTF Exchange V2 uses Solady ECDSA.recover() (also handles zero-address). No raw ecrecover() without guards found in signature validation path.

RD-F-020 green EIP-712 domain separator missing chainId EIP-712 domain separator uses OZ EIP712 base contract (_domainSeparatorV4()) which encodes block.chainid. Search results and docs confirm domain separator includes name, version, chainId, and verifyingContract.

RD-F-021 green UUPS _authorizeUpgrade correctly permissioned Only pUSD CollateralToken proxy uses UUPS pattern. Implementation _authorizeUpgrade() is gated to onlyOwner (OwnableRoles). CTFExchange V1/V2 are non-upgradeable. No open or missing _authorizeUpgrade found.

RD-F-022 green Public initialize() without initializer modifier No unprotected initialize() found. CTFExchange V1/V2 use constructors (non-upgradeable). pUSD implementation has initialize(address) with initializer modifier AND _disableInitializers() in constructor. No F022 vulnerability present.

RD-F-023 green Constructor calls _disableInitializers() pUSD implementation constructor calls _disableInitializers(). CTFExchange V1/V2 are non-upgradeable (constructor pattern) — factor N/A for exchange contracts but applicable to pUSD implementation where it is correctly implemented.

Governance & admin Yellow 42 24 of 24

RD-F-032 red Timelock duration on upgrades No timelock contract exists. Admin multisig can call all admin functions (pauseTrading, addAdmin, addOperator, setFeeReceiver) with immediate effect upon multisig approval. data cache timelock_address = null. Auth.sol source confirms no queuing mechanism. RD-F-033 red Timelock on sensitive actions No timelock on any of the five sensitive action categories. mint (owner grants MINTER_ROLE, no timelock); pause (direct admin call, no timelock); rescue (no function); setOracle (UMA adapter reset direct, emergencyResolve has 2-day flagging delay only); upgrade (pUSD UUPS _authorizeUpgrade onlyOwner, no timelock). RD-F-034 red Guardian/pause-keeper distinct from upgrader No separate guardian/pause-keeper role. CTFExchange V2 admin multisig (0x3dce0a29) holds both pause authority and operator-management. pUSD owner controls both UUPS upgrade and MINTER_ROLE grants. Same entity controls all sensitive roles. RD-F-035 red Role separation: upgrade ≠ fee ≠ oracle No role separation. CTFExchange admin controls upgrade (addAdmin), fee (setFeeReceiver), and oracle-config (operator grants, which execute market resolution). pUSD owner controls upgrade (UUPS) and fee/inflation (MINTER_ROLE). Single admin controller for all three role types. RD-F-025 yellow Admin key custody type CTF Exchange V2 admin is a Gnosis Safe multisig (0x3dce0a29139a851da1dfca56af8e8a6440b4d952) — multisig without timelock. pUSD owner transferred post-deploy to undisclosed address. No DAO, no timelock controller. RD-F-026 yellow Upgrade multisig signer configuration (M/N) 2-of-4 Gnosis Safe confirmed via third-party analysis. Four EOA signers: 0xd4848efd…, 0xf65df17d…, 0x80AbC332…, 0x00447a08…. Safe API unavailable (403/422); confirmed via iter.ca analysis. RD-F-028 yellow Low-threshold multisig vs TVL [★] 2-of-4 threshold for $514M TVS. Peer norm at this TVL band is 3-of-5 or higher. Signer identities not publicly attested. One below peer norm. RD-F-031 yellow Signer rotation recency No AddedOwner/ChangedThreshold events visible in accessible Polygonscan history for Safe 0x3dce0a29. Threshold reduction (DPRK-precursor pattern) not observed. Rated yellow due to incomplete event history visibility, not confirmed green. RD-F-041 yellow Rescue/emergencyWithdraw without timelock [★] No rescue/emergencyWithdraw/sweep in CTFExchange V2 (Assets.sol, Auth.sol confirmed). UMA CTF Adapter emergencyResolve gated behind 2-day flag window. Admin pauseTrading is immediate but cannot extract funds. No single-tx drain-via-rescue. Rated yellow for ungated pauseTrading (immediate, no timelock). RD-F-042 yellow Admin has mint() with unlimited max [★] pUSD CollateralToken has mint() gated to MINTER_ROLE (not directly admin). Owner can grant MINTER_ROLE without timelock. No supply cap in contract. Two-step uncapped inflation path (addMinter + mint). Owner identity not publicly disclosed. No timelock intermediates any step. RD-F-167 yellow Deprecated contract paused but pause reversible by live admin CTFExchange V1 (0x4bFb41d5) remains active (1M+ txs, still processing April 29 2026). Described as sunset but not paused. V1 admin (originally deployer EOA 0x81fd0E5E who performed renounce-then-add pattern) retains pause authority. Admin can pause V1 trading at will. No timelock on V1 admin actions. RD-F-029 gray Multisig signers co-hosted 4 EOA signers identified but no ASN/data-center/custodian analysis possible from on-chain data. Co-hosting cannot be confirmed or denied. RD-F-030 gray Hot-wallet signer flag Signer behavioral heuristics (nonce velocity, gas jitter) not assessable via WebFetch. Cannot confirm or deny hot-wallet pattern for any of 4 EOA signers. RD-F-036 n/a Flash-loanable voting weight [★] No governance token, no on-chain Governor, no Snapshot. Polymarket is operated by Blockratize Inc. (Delaware C-corp). Flash-loanable voting is not applicable by construction. RD-F-037 n/a Quorum achievable via single-entity flash loan No on-chain governance; quorum via flash loan not applicable by construction. RD-F-038 n/a Proposal execution delay < 24h No governance proposals, no voting period, no execution delay mechanism. Not applicable by construction. RD-F-039 n/a delegatecall/call in proposal execution without allowlist [★] No governance executor, no proposal payload mechanism, no delegatecall in proposal path. Not applicable by construction. RD-F-040 n/a Emergency-veto multisig present No governance proposal queue to veto or cancel. Admin can pause trading directly (same multisig). No separate veto mechanism needed or applicable. RD-F-045 gray Constructor args match governance proposal No governance proposal mechanism exists. Deploy was a unilateral team decision with no public governance proposal to cross-check constructor args against. Args are verifiable on-chain but no reference document exists. RD-F-047 n/a Governance token concentration (Gini) No governance token exists. No voting power distribution. Not applicable by construction.

RD-F-027 green Single admin EOA [★] Admin is Gnosis Safe 0x3dce0a29 (not EOA). Deploy-factory contract was deployer. No single EOA holds admin role.

RD-F-043 green Admin = deployer EOA after 7 days [★] CTFExchange V2 admin set to multisig 0x3dce0a29 at deploy (constructor arg). Deployer was a factory contract (0x0268bdAF). pUSD deployer (0xca71ea69) performed Transfer Ownership and Grant Roles post-deploy. No EOA-retention pattern.

RD-F-044 green Admin wallet interacts with flagged addresses Admin Safe 0x3dce0a29 holds WPOL and minor tokens. No OFAC-listed or mixer-linked counterparties identified in visible transaction history. No Chainalysis hit.

RD-F-046 green Contract unverified on Etherscan/Sourcify [★] All core contracts verified on Polygonscan (exact match): CTFExchange V2 (v0.8.34), pUSD impl (0x6bBCef9f), Neg Risk CTF Exchange, Neg Risk Adapter, CTFExchange V1 (v0.5.10), Conditional Tokens.

Oracle & external dependencies Yellow 33 17 of 17

RD-F-180 red Immutable oracle address [★ CRITICAL — RED] Primary UMA CTF Adapter (0x6A9D222616C90FcA5754cd1333cFD9b7fb6a4F74) declares IOptimisticOracleV2 public immutable optimisticOracle. No setter function exists. Admin cannot replace oracle address without redeploying adapter and migrating all active markets. Matches F180 definition: oracle source address not programmatically replaceable by admin action without full protocol upgrade. Legacy v1 adapter (0xCB1822859cEF82Cd2Eb4E6276C7916e692995130, since re-tagged on Polygonscan as 'UMA Optimistic Oracle'; verified source class still UmaConditionalTokensBinaryAdapter) has mutable Finder with setFinderAddress() but is not the primary path for new market creation. Partial mitigation: emergency resolution admin bypass exists; Chainlink integration covers price-market class only. F180 fully promoted to star-critical by T-14 2026-04-22. RD-F-048 yellow Oracle providers used Two oracle providers: (1) UMA Optimistic Oracle v2 at 0xCB1822859cEF82Cd2Eb4E6276C7916e692995130 (Polygon) — truth-attestation oracle for binary market outcome resolution via UMA CTF Adapter 0x6A9D222616C90FcA5754cd1333cFD9b7fb6a4F74. (2) Chainlink Data Streams (September 2025) — price-feed oracle for price-based short-duration markets (BTC, ETH). 9 Chainlink feeds in data cache are ecosystem feeds not directly called by Polymarket contracts. No price oracle for pUSD collateral (1:1 USDC fixed). RD-F-049 yellow Oracle role per asset UMA OO role: Primary and sole resolution oracle for all binary event markets. No secondary, no fallback. Chainlink Data Streams role: Primary price-delivery oracle for price-based markets since September 2025. pUSD: no oracle — 1:1 USDC fixed. Each oracle class has no confirmed fallback at the Polymarket integration layer. RD-F-050 yellow Dependency graph (protocols depended upon) Polymarket depends on: (1) UMA Protocol (OO + DVM) — sole outcome resolver; failure freezes all binary market resolutions. (2) Gnosis CTF 0x4D97DCd97eC945f40cF65F87097ACe5EA0476045 — ERC-1155 outcome token accounting; compromise affects all positions. (3) Circle USDC — pUSD backing; pause freezes all collateral ops. (4) Chainlink Data Streams — price-market resolution (added September 2025). (5) Canonical Polygon PoS bridge — USDC ingress (not Polymarket-operated). RD-F-051 yellow Fallback behavior on oracle failure No automated fallback for UMA OO failure. Emergency admin override exists via flagQuestionForEmergencyResolution() + emergencyReportPayouts() (auth ward system, admin-only centralized bypass). V1 Binary Adapter has setFinderAddress() for oracle indirection. V2 primary adapter has no fallback. No confirmed Chainlink Data Streams fallback path. Centralized emergency path is a partial mitigant, not an automated fallback. RD-F-052 yellow Breakage analysis per dependency If UMA OO fails: resolution freezes, $514M TVS locked pending admin emergency or UMA restoration. If UMA DVM corrupted (>50% token vote): disputed resolutions adversarially settable; attack cost ~$14M at 2026-04 UMA prices. If Gnosis CTF exploited: all outcome token accounting at risk. If Circle USDC paused: pUSD depegs, collateral frozen. If Chainlink Data Streams fails: price-market settlement halts (September 2025 market class). RD-F-062 yellow External keeper/relayer not redundant Chainlink Automation (September 2025) is a keeper dependency for automated settlement of price-based markets. UMA OO resolution path is permissionless (any address can propose and dispute) — no keeper SPOF for binary markets. Chainlink Automation introduces a keeper SPOF for the price-market class without confirmed redundancy. Yellow: partial keeper risk for the Chainlink market class only. RD-F-053 n/a Oracle source = spot DEX pool (no TWAP) [★ CRITICAL — N/A] Polymarket does not consume a spot DEX pool price feed for any operational purpose. pUSD is 1:1 USDC fixed (no dynamic pricing). Outcome tokens (YES/NO) are priced via off-chain CLOB. UMA OO is a truth-attestation oracle, not a price-feed oracle. No DEX pool price is read by any Polymarket contract. N/A by factor definition for prediction market protocol-type. RD-F-054 n/a TWAP window duration No TWAP oracle consumed by Polymarket. UMA OO is truth-attestation, not TWAP. Chainlink Data Streams is push-based, not TWAP. N/A by same basis as F053. RD-F-055 n/a Oracle pool depth (USD) No DEX pool oracle consumed. UMA OO resolution is not sourced from a DEX pool. N/A. RD-F-056 n/a Single-pool oracle (no medianization) No DEX pool oracle consumed. N/A by same basis as F053. RD-F-057 n/a Circuit breaker on price deviation No price feed consumed by Polymarket core contracts requiring a deviation circuit breaker. UMA dispute mechanism serves as a human-arbitration analog. N/A in standard price-oracle sense. RD-F-058 n/a Max-deviation threshold (bps) No circuit breaker on a price oracle; no threshold exists. N/A by same basis as F057. RD-F-059 n/a Oracle staleness check present No time-decaying price feed consumed. UMA OO 2-hour dispute window is a temporal resolution check, not an oracle data-freshness staleness check in the standard RD-F-059 sense. Chainlink Data Streams staleness not confirmed. N/A for standard oracle-staleness factor. RD-F-181 n/a Permissionless-pool lending oracle Factor applies to lending protocols accepting spot prices from permissionless DEX pools as collateral oracle input. Polymarket is a prediction market, not a lending protocol. No borrow/collateral surface; no oracle-acceptance configuration from permissionless pools. Binary outcome tokens not used as collateral in a lending market by Polymarket's own contracts. N/A by protocol-type.

RD-F-060 green Chainlink aggregator min/max bound misconfig Chainlink feeds in data cache (BTC/USD, ETH/USD, etc.) are not consumed by Polymarket's own contracts for collateral pricing or liquidation. No IChainlinkAggregator import in CTF Exchange V2 or UMA CTF Adapter. Chainlink Data Streams (September 2025) uses verifiable off-chain push reports, not the legacy AggregatorV3 min/max bounds pattern. Classic minAnswer/maxAnswer misconfig not applicable to this integration architecture.

RD-F-061 green LP token balanceOf used for pricing Polymarket does not use LP token balanceOf for pricing. pUSD is 1:1 USDC (CollateralOnramp enforces 1:1 mint). Outcome tokens priced by off-chain CLOB. No donation-manipulable balanceOf pricing path. CollateralOnramp source confirms 1:1 wrap with no price oracle.

Economic risk Green 17 13 of 13

RD-F-063 green TVL (current + 30d trend) TVL = $514,188,861 on Polygon (100%), 30-day change +11.38%, 7-day change +8.1%. Current reading constitutes the all-time high, slightly exceeding October 2024 peak ($511.9M). Trend is up. Collateral is 100% USDC-equivalent (pUSD backed 1:1 by Circle USDC since April 28, 2026 upgrade). TVL reflects collateral locked in open CTF outcome token positions, not lending supply.

RD-F-072 green Market-listing governance threshold Market listing is fully curated by the Polymarket markets team. Users may propose markets via Twitter/X; the team reviews and approves. No permissionless listing by external operators. This eliminates the permissionless-listing attack surface (the primary risk this factor targets). The absence of external operator listing rights means no malicious market can be inserted without team approval. Centralized curation introduces Polymarket Inc. counterparty risk (team can delist or refuse to list), but this is a governance/admin risk (Cat 2), not a Cat 4 economic risk.

Operational history Yellow 36 15 of 15

RD-F-082 red Post-mortem published within 30 days No public post-mortem found for any of the five operational incidents (Nov 2025 phishing, Dec 2025 auth breach, Feb 2026 nonce exploit, Mar 2025 UMA governance attack, 2022 CFTC fine). Only Discord statements and news coverage exist. Template: red = >90 days or not published. No post-mortem published for any incident. RD-F-085 red Incident response time (minutes) Dec 2025 auth breach: user reports began Dec 22–23; Polymarket official Discord statement Dec 24 = 24–48 hour delay (1,440–2,880 minutes). Well above 240-minute red threshold. Feb 2026 nonce exploit: no official statement or post-mortem issued at all — community developer built Nonce Guard independently. Template: red = >240 min or no statement. Both primary incidents exceed this threshold. RD-F-089 red Insurance coverage active No active insurance coverage found on Nexus Mutual, Sherlock, Unslashed, or equivalent. Multiple searches confirmed no Polymarket coverage listing on major DeFi insurance providers. TVL is $514M. Template: red = no active coverage. Scoring red. RD-F-077 yellow Prior exploit count Zero smart-contract-level exploits (REKT DB empty, data cache rekt.incidents: []). Three frontend/operational incidents with user losses: Nov 2025 phishing (~$500K, unrecovered); Dec 2025 auth breach (undisclosed amount, unrecovered); Feb 2026 nonce manipulation (~$16K+ confirmed). UMA governance attack Mar 2025 also resulted in user losses with no compensation. The $500K phishing loss is unrecovered, preventing a green score. No full-recovery single-exploit scenario — yellow is the appropriate band. RD-F-080 yellow Days since last exploit Most significant user-affecting incident: Dec 24, 2025 auth breach. Days since Dec 24 2025 to Apr 29 2026 = 126 days. Falls in yellow range (90–365 days). The Feb 2026 nonce exploit is ~73 days ago but primarily affected market-making bots, not ordinary users. Using Dec 2025 as primary reference gives yellow. RD-F-081 yellow Post-exploit response score Dec 2025 auth breach response: (1) Compensation completeness 1/5 — none offered; (2) Disclosure transparency 2/5 — Discord only, no provider named, no loss figures; (3) Root-cause depth 2/5 — 'third-party authentication provider' only; (4) Recovery speed 3/5 — reportedly remediated within ~24h. Composite ~2/5 = yellow. UMA governance attack (Mar 2025) similarly scored ~2/5: result declared final, no compensation, called unprecedented but no structured post-mortem. RD-F-084 yellow TVL stability (CoV over 90d) Data cache reports 30d TVL change +11.38% and current TVL $514.2M. DeFiLlama API fetch returned TVL data in a range inconsistent with the data cache ($85M–$170M vs $514M current), suggesting a data quality issue with the API endpoint (possibly returning open interest or a different metric). Using qualitative evidence: Nov 2025 phishing caused a 12% TVL drop in 24 hours; V2 upgrade (Apr 28 2026) creates near-term transition volatility. CoV is estimated in the 0.15–0.35 yellow range but cannot be confirmed programmatically due to data discrepancy. Flagged for data pipeline review. RD-F-086 yellow Pause activations (trailing 12 months) The April 28 2026 V2 upgrade involved a planned ~1 hour trading pause (documented in Help Center announcement). This constitutes 1 documented pause with documented reason in the trailing 12 months. Template: yellow = 1–2 pauses with documented reason. No emergency/undocumented pause found. RD-F-088 yellow Re-deployed to new addresses in last year CTF Exchange V2 at 0xE111180000d2663C0091e4f400237545B87B996B deployed ~2026-03-31, went live 2026-04-28, retiring V1 at 0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E. A developer migration guide was published at docs.polymarket.com/v2-migration; Help Center user guidance published; residual V1 balance is de minimis. Template: yellow = redeployment with documented migration path and user communication. Migration was communicated; yellow (not red) because documentation was provided. RD-F-083 gray Auditor re-engaged after last exploit No smart-contract-level exploit occurred — therefore no post-exploit re-audit is applicable. The CTF Exchange V2 audits (Quantstamp + Cantina, March 2026) are proactive version-upgrade audits, not post-incident re-audits. Template: gray = no prior exploits (N/A). Applying gray.

RD-F-076 green Protocol age (days) Polymarket launched June 2020 per CFTC press release 8478-22. As of 2026-04-29 that is approximately 71 months (~2,160 days). Threshold: green ≥365 days. Well exceeds.

RD-F-078 green Chronic-exploit flag (≥3 incidents) Zero smart-contract-level exploits. CHRONIC flag (≥3 incidents with same root cause in 24 months, ≥2 post-disclosure) does not fire. Frontend/operational incidents differ in root cause (phishing links vs auth provider vs off-chain sync flaw). CHRONIC badge does not apply.

RD-F-079 green Same-root-cause repeat exploit Nov 2025 phishing (social engineering via comment links) and Dec 2025 auth breach (backend authentication provider) are both auth-surface incidents but have distinct attack vectors and root causes. No same-root-cause cluster repeat at the smart-contract level. Scoring green.

RD-F-087 green Pause > 7 consecutive days V2 upgrade maintenance window was approximately 1 hour. No extended pause >7 consecutive days found in the last 12 months. Scoring green.

RD-F-166 green Deprecated contracts still holding value CTF Exchange V1 (0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E) deprecated April 28 2026. Polygonscan shows ~$9,275 USDC + ~$300 other tokens = ~$9,575 total residual as of 2026-04-29. Well below the $100K materiality threshold defined in F166. Green.

Real-time signals Green 11 22 of 22

RD-F-104 yellow Stablecoin depeg >2% on shared-LP venue Applicable — highest-impact signal for Polymarket. pUSD (collateral for all $514M TVL) is backed 1:1 by USDC; no algorithmic peg, no fractional reserve. Protocol exposure = 100% of TVL (threshold is ≥5%). If USDC depegs >2% on ≥2 venues for ≥30 min, RD-F-104 would fire immediately. USDC/USD Chainlink feed on Polygon (0xfE4A8cc5b5B2366C1B58Bea3858e81843581b2F7, heartbeat 27s) is the primary monitoring source. Current posture: USDC at peg today — signal would not fire right now. Scored yellow because structural exposure is maximum (100% concentration in single stablecoin vs typical 18-30% for lending protocols) — signal is armed and would fire at threshold. RD-F-090 n/a Mixer withdrawal → protocol interaction Applicable: wallet clustering feed required. Threshold: mixer withdrawal within 30 days + >$100k interaction with CTF Exchange + ≥2 attribution sources. Current posture: no public attribution of mixer-funded wallet interacting with Polymarket CTF Exchange contracts. Requires Chainalysis or TRM Labs license for 3-hop analysis. v1-deferred per T-09 phase 2. RD-F-091 n/a Partial-drain test transactions v1-deferred. No partial-drain test transaction pattern against CTF Exchange V2 ($0xE111180000d2663C0091e4f400237545B87B996B) documented. V2 migration on 2026-04-28 was a pre-announced event (suppression applies). Not in v1 monitoring scope. RD-F-092 n/a Unusual mempool pattern from deployer wallet v1-deferred. Deployer 1 (0xca71ea69c54c163d17beb90beb8d001e1eb538a1) deployed V2 contracts 2026-03-31. No post-deploy unusual mempool pattern observed. Not in v1 monitoring scope. RD-F-093 n/a Abnormal gas-price willingness from attacker wallet v1-deferred. No attacker wallet with abnormal gas-price willingness targeting CTF Exchange contracts identified on Polygon. Polygon MEV dynamics differ from Ethereum mainnet; gas-fee-race signal applicability is reduced. RD-F-094 n/a New contract with similar bytecode to exploit template v1-deferred. No similar-bytecode contract deployment to CTF Exchange or CTF documented. Feb 2026 malicious GitHub bot campaign used npm typosquatting (ts-bign, big-nunber), not on-chain bytecode clones. Not in v1 monitoring scope. RD-F-095 n/a Known-exploit function-selector replay v1-deferred. Nonce-race exploit via incrementNonce() on CTF Exchange disclosed 2026-02-19 (@itslirrato on X) — this is a loss-avoidance pattern by losing traders, not a theft-class exploit. V2 migration likely addresses this. No catastrophic selector-replay documented. Not in v1 scope. RD-F-096 n/a New ERC-20 approval to unverified contract from whale v1-deferred. User proxy wallets (1-of-1 Gnosis Safe) grant approvals to CTF Exchange. Sep 2024 phishing campaign used proxy function calls to move USDC. Pattern documented but not a wired v1 signal. RD-F-097 n/a Sybil surge of identical-pattern transactions v1-deferred. Wash trading concerns reported by Fortune (Oct 2024) but these are market-manipulation at the CLOB layer, not sybil attacks on CTF settlement contracts. Not in v1 monitoring scope. RD-F-099 n/a Oracle price deviation >X% from secondary v1-deferred. Unique oracle architecture: Polymarket uses UMA Optimistic Oracle for truth-attestation (not price deviation). Chainlink feeds present on Polygon (USDC/USD at 0xfE4A8cc5b5B2366C1B58Bea3858e81843581b2F7) but consumer contracts not confirmed as direct Polymarket dependencies. Signal architecture requires reframing for prediction market context. UMA DVM manipulation (whale attack March 2025) is a governance-layer event, not price-deviation. Not assessable via standard RD-F-099 detection rule. RD-F-100 n/a Flash loan >$10M targeting protocol tokens v1-deferred. Low applicability: CTF Exchange is a settlement venue, not a lending protocol. Flash loans cannot manipulate CTF token prices because 1 YES + 1 NO = 1 pUSD is fully-collateralized and invariant. No documented flash-loan attack vector for CTF architecture. Not in v1 monitoring scope. RD-F-101 n/a Large governance proposal queued Not applicable: Polymarket has no on-chain governance. Governor contract = null (data cache: governance.governor_address=null). No Snapshot space (snapshot_space=null). No token. UMA DVM governance (whale attack March 2025 via UMIP voting) is UMA-protocol-level, not a Polymarket contract signal. UMIP-189 MOOV2 upgrade created managed proposer whitelist — positive change reducing manipulation risk. Signal cannot fire by construction. RD-F-102 n/a Admin/upgrade transaction in mempool v1-deferred. Applicable: CTF Exchange V2 (0xE111180000d2663C0091e4f400237545B87B996B) has admin role that can pause, change fee receiver, add/remove operators. Admin wallet identity not publicly disclosed; safe_multisigs=[] in data cache. Signal cannot be wired up without the admin address. V2 deployed 2026-03-31 via Deployer 1 (0xca71ea69c54c163d17beb90beb8d001e1eb538a1). No unusual admin tx observed post-V2 launch. RD-F-103 n/a Bridge signer-set change proposed/executed Not applicable: Polymarket operates no bridge contracts. Polygon PoS bridge is not Polymarket-operated. layerzero.present=false in data cache. No bridge contract in deployment set. Signal cannot fire by construction. RD-F-106 n/a Cross-chain bridge unverified mint pattern Not applicable: Polymarket does not operate a cross-chain bridge. No bridge contract in deployment set. Signal cannot fire by construction. RD-F-107 n/a Admin EOA signing from new geography/device v1-deferred. Applicable in principle (Polymarket admin key held by company employees). Not assessable from on-chain data — requires off-chain signing telemetry (MPC/session-key provider data) not publicly available. RD-F-108 n/a GitHub force-push to sensitive branch v1-deferred. Applicable. Last commit to ctf-exchange repo: 2026-02-03 (data cache). Malicious bot campaign (Feb 2026) operated through hijacked third-party org (dev-protocol), not Polymarket's own GitHub org. No force-push to Polymarket repos documented. Not in v1 monitoring scope. RD-F-109 n/a Social-media impersonation scam spike v1-deferred. Applicable — multiple documented impersonation campaigns: Nov 2025 phishing in market comment sections (>$500k), Feb 2026 malicious bot repos (20+ fake repos on hijacked dev-protocol GitHub org). Signal would fire if wired up. Not in v1 monitoring scope. RD-F-110 n/a Unusual pending/executed proposal ratio Not applicable: no on-chain governance. governance.governor_address=null in data cache. UMA oracle governance is UMA-protocol-level. Signal cannot fire by construction. RD-F-182 n/a Security-Council threshold reduction (RT) Not applicable: Polymarket has no Security Council multisig governance structure. safe_multisigs=[] in data cache; no confirmed multisig. Admin key is single company-held key with no threshold to reduce. Drift Protocol RD-F-182 pattern (3/5 SC threshold reduction preceding $285M DPRK exploit) does not map to Polymarket's architecture. Signal cannot fire by construction.

RD-F-098 green TVL anomaly — % drop in <1h Applicable. Threshold: TVL drops >30% in 60-minute window vs 30-day baseline. Current TVL: $514,188,861 on Polygon (DeFiLlama API, 2026-04-29T15:57:16Z). 1d change: +1.07%; 30d change: +11.38%. No TVL anomaly observed. V2 migration on 2026-04-28 involved planned ~1h trading pause — pre-announced (suppression applies). Signal would not fire today.

RD-F-105 green DNS/CDN/frontend hash drift Applicable. polymarket.com is the primary user-facing surface. Current DNS appears stable (no reports of DNS hijacking or cert change as of 2026-04-29). Phishing campaigns (Nov 2025, >$500k) and malicious bot impersonation (Feb 2026) operate off-domain (fake comment links, typosquatted GitHub repos) — these would not trigger the DNS/hash-drift signal. Signal correctly not firing today. Elevated threat environment noted in Cat 11 (RD-F-161).

Dev identity & insider risk Green 7 16 of 16

RD-F-116 yellow Contributor tenure at admin-permissioned PR GitHub ctf-exchange last commit 2026-02-03 per data cache. Public contributor handles visible in issues: joshstevens19 (VP Eng, 4+ years DeFi, substantial tenure). Admin-permissioned contract configuration for V2 was done off-chain by Polymarket Inc. — not gated by GitHub PR process. No admin-permissioned PR identified in the 5 open issues (all documentation/API queries). Cannot assess tenure of whoever held the admin key at V2 deploy. Yellow because admin ACL change is insider-only, contributor tenure for off-chain role is not assessable. RD-F-119 yellow Commit timezone consistent with stated geography Josh Stevens states England location (UTC+0/+1); Coplan is NYC-based (UTC-5). GitHub commit-hour distribution not accessible — GitHub contributor graphs are JS-rendered SPAs (confirmed per process-learnings FAILED pattern). No specific DPRK timezone anomaly found in OSINT. Yellow because full commit-time analysis was not achievable, not because an anomaly was found. RD-F-123 yellow Sudden admin-rescue/ACL change without discussion V1→V2 migration included deployment of CTF Exchange V2 (deployed 2026-03-31, live 2026-04-28) with new admin/operator role assignments. Macro upgrade announced 2026-04-07 (~21 days before go-live) with dual audit (Quantstamp + Cantina, March 2026). However: (1) no public governance forum exists; (2) admin/operator addresses for V2 are not publicly disclosed; (3) V2 contract was on-chain 4 weeks before public announcement; (4) all ACL changes are insider-only by design in Polymarket's centralized model. Upgrade was publicly pre-announced (mitigating); insider-only role assignment with zero public discussion is a structural gap. Not red: 3-week notice and dual audit coverage; no evidence of surprise or concealed change. RD-F-117 gray ENS/NameStone identity bound to deployer Deployers are on Polygon mainnet. ENS is Ethereum mainnet and is not standard for Polygon addresses. No ENS name found bound to 0xca71ea69 or 0x4df6f457 on Polygonscan. Factor is not applicable in the meaningful sense for Polygon-native deployers — ENS resolution on Polygon is non-standard.

RD-F-111 green Team doxx status Founder Shayne Coplan is fully real-name doxxed with Wikipedia article, CBS 60 Minutes interview, Senate-level regulatory exposure, Fortune, Decrypt Person of Year 2024. VP Engineering Josh Stevens real-name doxxed with verifiable prior employer (Aave SVP). CMO, CLO, Director Finance publicly named. Several GitHub org contributor handles are pseudonymous (@ExoMonk, @rahul-polymarket, @sherrbss) but these are contributor-level, not admin-level. Overall classification: real-name at leadership level.

RD-F-112 green Team public accountability surface Coplan: NYU (CS dropout), LinkedIn, 60 Minutes, Fortune, Decrypt POTY 2024, MIT Sloan Sports Analytics speaker, Crunchbase, ~$1B attributed net worth. Josh Stevens: LinkedIn, GitHub (946 followers, 49 repos), prior Aave SVP Eng role, personal site joshstevens.io, Twitter @devjoshstevens. Suhail Kakar: LinkedIn, GitHub, Dev.to, ZoomInfo. Multiple verifiable public trails per leadership member.

RD-F-113 green Team other-protocol involvement history Josh Stevens was SVP Engineering at Aave (Tier-1 DeFi, no rug history). Coplan's prior project was Union Market (pivoted to Polymarket in 2020 — no rug or exploit history). Suhail Kakar: web3 developer, no prior rug linkage found. No team member linked to prior rug, exit scam, or exploited protocol in any public source.

RD-F-114 green Deployer address prior on-chain history Deployer 1 (0xca71ea69): 23 total transactions, pure deploy-and-configure pattern (Deploy And Call, Grant Roles). First tx was operational funding 2026-03-30. Deployer 2 (0x4df6f457): historical CTF pre-launch deploy address from 2020; clean pattern. Neither address linked to prior rug in available on-chain or OSINT data.

RD-F-115 green Prior rug/exit-scam affiliation No evidence found of any Polymarket team member (Coplan, Stevens, Kakar, Modabber, Kumar, Perla-Ward, board members) linked to a prior rug or exit-scam protocol. Polycule (third-party bot) and PolySized (clone) are external actors unaffiliated with Polymarket team. ISW-employee $200K market manipulation (Nov 2025) was an external market participant, not a team member. Rekt DB contains no Polymarket entries.

RD-F-118 green Handle reuse across failed/rugged projects No evidence found of Polymarket GitHub org handles (@shwinky789, @joshstevens19, @suhailkakar, @sherrbss, @harley-poly, @martin-poly, @rahul-polymarket, @ExoMonk) previously associated with rugged or failed protocols. Malicious Polymarket-mimicking bots (dev-protocol org hijack) are unrelated external actors. No handle reuse across rug-adjacent projects found.

RD-F-120 green Video-off/voice-consistency flag Shayne Coplan has appeared on video: CBS 60 Minutes (TV interview), Decrypt video content, MIT Sloan Sports Analytics Conference (in-person), multiple podcast appearances. Josh Stevens has conference presence. No video-off, voice inconsistency, or timezone-inconsistency flag observed in public interview record.

RD-F-121 green Contributor OSINT depth score Coplan: 5/5 (Wikipedia, major media trail, regulatory record with FBI/CFTC/DOJ, LinkedIn, conference). Stevens: 4/5 (LinkedIn, prior employer Aave, GitHub 946 followers, personal site, Twitter). Kakar: 3/5 (LinkedIn, GitHub, Dev.to). Leadership team OSINT depth is above-average for DeFi sector.

RD-F-122 green Contributor paid to DPRK-cluster wallet No evidence found of contributor payment wallet routing to DPRK-labeled cluster within 3 hops. Deployer wallets (0xca71ea69, 0x4df6f457) checked via Polygonscan label coverage — no DPRK/Lazarus label on either or their immediate funding sources. OSINT search for Polymarket + DPRK/Lazarus returns zero hits.

RD-F-124 green Deployer wallet mixer-funded within 30 days Deployer 1 funded ~29 days before V2 deploy (2026-03-30) from address 0x365d42E7...9e37f7997 with 70 POL. No Tornado Cash, Railgun, or other mixer label on this funding address per Polygonscan. Deployer 2 funded 5+ years before V2 deploy — outside the 30-day RD-F-124 window. No mixer-funded deployer within 30 days of V2 deployment found. Confidence medium: label-layer only, no Chainalysis API access.

RD-F-125 green Deployer linked within 3 hops to DPRK/Lazarus No evidence of DPRK/Lazarus proximity within 3 hops of any Polymarket deployer or known admin address. Polygonscan label check: no DPRK/Lazarus designation on Deployer 1 or Deployer 2 or their immediate funding sources. OSINT: 'Polymarket Shayne Coplan DPRK OR Lazarus OR North Korea' search returns zero relevant hits. FBI investigation (2024) was US election-betting compliance; DOJ/CFTC dropped all investigations 2025-07-15. Lazarus Group entry on OFAC SDN confirmed (https://sanctionssearch.ofac.treas.gov/Details.aspx?id=27307) but no Polymarket address appears proximate. Confidence medium: 3-hop traversal not achievable without Chainalysis/Arkham API.

RD-F-184 green Real-capital social-engineering persona No evidence found of a team contributor or external integrator persona with >=1M USD in attributed real-capital deposits to Polymarket or peer protocols used to build credibility ahead of a social-engineering attack. The Van Dyke insider-trading case (US Special Forces soldier using classified info) is an external market participant, not a social-engineering developer persona. The ISW employee who manipulated a Ukraine map for market gain (~$200K, Nov 2025) is an external actor. The Drift Protocol C17-class UNC4736 pattern (real-capital persona buildup, conference attendance, durable-nonce pre-signing) has no analog found in Polymarket's developer history. M-only factor; no positive finding.

Fork / dependency lineage Green 3 10 of 10

RD-F-135 yellow Shared-library version with known-vuln status OZ contracts pinned to SHA 8769b198 (V1) — exact version tag not resolved. Solady pinned to SHA acd959aa (both repos). No active GHSA high/critical advisory found for these library versions from public GHSA search, but exact OZ version tag from SHA not confirmed. Confidence low.

RD-F-126 green Is-a-fork-of ConditionalTokens (0x4D97DCd9...) is the Gnosis CTF open-standard contract deployed verbatim on Polygon. Polymarket docs: 'CTF is an open standard developed by Gnosis.' CTF Exchange V1/V2, NegRiskAdapter, UMA CTF Adapter are original Polymarket development. Upstream clearly identified for the CTF layer.

RD-F-127 green Upstream patch not merged Gnosis CTF upstream appears effectively frozen — no security patches published since ~2019-2020. No upstream security patch unmerged. Trust Security 2025 prepareCondition() disclosure is a design limitation of all CTF implementations, not a Gnosis-patched vulnerability.

RD-F-128 green Upstream vulnerability disclosure (last 90d) No public security advisory or vulnerability disclosure for Gnosis CTF in the trailing 90 days (January 29 to April 29, 2026). Gnosis CTF is a frozen unmaintained reference implementation with no active upstream advisory.

RD-F-129 green Code divergence from upstream (%) ConditionalTokens deployment on Polygon is verbatim Gnosis CTF standard (Polygonscan 'Exact Match' verification). Divergence is ~0%. CTF Exchange V1/V2 are original code with no upstream to diff against.

RD-F-130 green Fork depth (generations from original audit) ConditionalTokens: depth 0 — direct deployment of originally audited Gnosis CTF. Gnosis CTF audited pre-2020 by Gnosis, and additionally ChainSecurity April 2024 for Polymarket's deployment. CTF Exchange: original code, N/A.

RD-F-131 green Fork retains upstream audit coverage ConditionalTokens has fresh independent audit (ChainSecurity April 2024). CTF Exchange V2 has fresh dual audit (Cantina + Quantstamp March 2026). CTF Exchange V1 has ChainSecurity 2022 audit (V1 now sunset). Comprehensive audit coverage across fork and original components.

RD-F-132 green Fork has different economic parameters than upstream ConditionalTokens deployed with identical parameters to Gnosis CTF standard — no economic parameter customization. CTF Exchange V1/V2 are original code with no upstream economic parameters to differ from.

RD-F-133 green Dependency manifest uses unpinned versions CTF Exchange V1 submodules all pinned to exact SHA commits: forge-std (1801b054...), openzeppelin-contracts (8769b198...), solady (acd959aa...), solmate (bff24e83...). CTF Exchange V2 submodules pinned: forge-std (0844d7e1...), solady (acd959aa...). All security-critical libraries pinned.

RD-F-134 green Dependency had malicious-release incident (last 90d) No security advisory for a malicious release affecting openzeppelin-contracts, solady, solmate, or forge-std in the trailing 90 days. These libraries are among the most scrutinized in the Ethereum ecosystem.

Post-deploy hygiene & change mgmt Yellow 23 13 of 13

RD-F-185 red Bridge rate-limiter / chain-pause as positive mitigant Polymarket does not operate a bridge. No per-window outflow rate-limiter in CTFExchange V2 (Pausable.sol = binary toggle only). No chain-level pause capability controlled by Polymarket. UMA CTF Adapter 2-day flag window is a resolution safety mechanism, not an outflow rate-limiter. F185 positive mitigant criteria not met. RD-F-136 yellow Deployed bytecode matches signed release tag No signed release tags in ctf-exchange-v2 GitHub repo (GitHub API /releases returned empty []). Deployed bytecode verified on Polygonscan (exact match) but not anchored to a signed git tag commit. Source is publicly verifiable but formal signed-tag provenance absent. RD-F-138 yellow Hot-patch deploys without timelock (last 30 days) No timelock on upgrade path (UUPS pUSD — onlyOwner, immediate). No hot-patch deploy events identified in last 30 days. Post-April-13 commits are docs-only. No upgrade executed. Rated yellow because the absence of a timelock means any future upgrade would bypass the declared (non-existent) timelock. RD-F-139 yellow Post-audit code changes without re-audit [★] Cantina + Quantstamp audits March 2026. Post-audit commits (pre-deploy): 'feat: pUSD (#90)' and 'chore: bump Solidity v0.8.34 (#86)' landed same week as audit PDF uploads. Residual concern: exact audit commit SHA not confirmed (binary PDFs). Post-deploy commits April 1–13 are metadata/docs only — no material source change. Cannot confirm all pre-deploy changes were inside audit scope without local git clone + commit SHA from PDFs. RD-F-145 yellow Deployed bytecode reproducibility Source verified on Polygonscan (exact match). foundry.toml present (solc v0.8.34, optimizer_runs = 1,000,000, EVM = Prague). Build should be reproducible. No signed release tag to anchor exact commit. Reproducibility is functionally available but not formally anchored. RD-F-146 yellow New contract deploys in last 30 days High count of new deploys in last 30 days: CTFExchange V2, CollateralToken proxy, NegRiskCtfExchangeV2, CtfCollateralAdapter, NegRiskCtfCollateralAdapter, CollateralOnramp, CollateralOfframp — all deployed ~March 31, 2026 per profile §3. V2 migration launched April 28, 2026. RD-F-168 yellow Stale-approval exposure on deprecated router CTFExchange V1 (0x4bFb41d5) operationally active (1M+ txs) as of April 29, 2026. V1 described as sunset but still processing Register Token txs. Users who approved V1 for ERC-1155 positions have not been explicitly advised to revoke in findable docs. No revoke-notice mechanism found.

RD-F-137 green Upgrade frequency (per 90 days) CTFExchange V2 is not a proxy — no upgrade path. pUSD CollateralToken (UUPS) was newly deployed in the 90-day window (initial deploy, not an upgrade). No Upgraded events. V1 is not a proxy.

RD-F-140 green Fix-merged-but-not-deployed gap No known post-mortem, security advisory, or GHSA documents a merged-but-undeployed fix for Polymarket V2 contracts. V2 is a fresh deploy. Rekt leaderboard empty.

RD-F-141 green Test-mode parameters in deploy No test-mode parameters identified. Constructor args set to production addresses (admin = 0x3dce0a29 Safe, collateral = USDC). Deployer performed Transfer Ownership (not retention). pUSD initialized with real owner.

RD-F-142 green Storage-layout collision risk across upgrades CTFExchange V2 is not a proxy (no upgrade path, no storage collision risk). pUSD CollateralToken UUPS uses OZ Upgradeable storage layout; constructor calls _disableInitializers(); initial deploy only (no prior implementation version to collide with).

RD-F-143 green Reinitializable implementation (no _disableInitializers) [★] pUSD impl (0x6bBCef9f) calls _disableInitializers() in constructor (confirmed from source). CTFExchange V2 is not a proxy — no reinitializer risk. Neg Risk Adapter is not a proxy. All proxied implementations correctly protected.

RD-F-144 green CREATE2 factory permits same-address redeploy CTFExchange V2 deployed via CREATE2 factory (fixed salt). Redeployment to same address requires identical bytecode — standard CREATE2 behavior. No evidence of redeployable-to-same-address vulnerability beyond standard mechanics.

Cross-chain & bridge Gray 0 12 of 12

Threat intelligence & recon Green 17 8 of 8

RD-F-161 yellow Protocol-impersonator domain registered (typosquat) Red-flag confirmed. Active and sustained impersonation campaign documented: (a) Phishing comment campaigns inside Polymarket market pages — Nov 2025 — redirected users to fake login pages, >$500k stolen (CoinSpot, Cryptopolitan); (b) 20+ fake repos on hijacked dev-protocol GitHub org impersonating Polymarket trading tools (StepSecurity, Feb 2026) — typosquatted npm packages stealing .env files; (c) CORS misconfiguration (wildcard origin + credentials=true) exploitable for cross-origin authenticated requests (Medium, Dec 2025). Specific WHOIS records for typosquat domains not retrieved (domain-monitoring feed required). Scored yellow (not red) because specific typosquat domain registrations are not confirmed via WHOIS — only confirmed phishing campaigns and impersonation repos. Would score red if domain-monitoring feed confirms active polymarket.com typosquat registrations. RD-F-164 yellow Leaked credential on paste/sentry site Elevated exposure. CVE-class vulnerabilities publicly documented: (a) Next.js middleware auth bypass CVE-2024-51479 (CVSS 7.5) affected Polymarket's route-level authentication checks; (b) CORS misconfiguration (wildcard origin + credentials=true) enabling cross-origin authenticated API requests; (c) xorcat claimed API enumeration via undocumented endpoints + pagination bypass (Apr 2026, disputed as public data scraping by Polymarket). Immunefi bug bounty received 400+ submissions within days of Apr 2026 launch, confirming active researcher engagement with vulnerabilities. No confirmed leak of smart contract admin private keys or admin wallet material. Scored yellow — API/frontend credential exposure elevated above baseline, smart contract key material not confirmed leaked. RD-F-158 n/a Known-threat-actor cluster has touched protocol Applicable. Threshold: address from curator threat-actor cluster interacted with CTF Exchange contracts within last 30 days with ≥1 confirmed exploit attribution. Current posture: no confirmed DPRK/Lazarus or known DeFi exploiter cluster interaction with Polymarket CTF contracts found in public sources. xorcat (Apr 2026) is a cybercrime forum actor performing API enumeration — not a known smart-contract exploit cluster. Requires Chainalysis or TRM Labs licensed feed for definitive assessment. v1-deferred. RD-F-159 n/a Attacker wallet pre-strike probe (low-gas failing txs) v1-deferred. Nonce-race exploit (Feb 2026) involved incrementNonce() calls by losing traders — a different pattern from attacker-cluster mempool probing. No external threat-actor mempool probe against CTF Exchange documented. Requires mempool + cluster feed not available without licensed partner. RD-F-160 n/a GitHub malicious-dependency incident touching protocol deps v1-deferred. Malicious npm packages ts-bign@1.2.8 and big-nunber@5.0.2 (Feb 2026 StepSecurity report) target trading bot developer environments, not Polymarket's Foundry-based Solidity contract dependencies. Polymarket's core contracts are Solidity/Foundry — not npm. The malicious packages impersonate big.js and bignumber.js. No confirmed GitHub Advisory against packages actually consumed by Polymarket contracts. RD-F-162 n/a Known-exploit-template selector deployed by any address v1-deferred. No known-exploit-template contract deployment documented targeting CTF Exchange or UMA OO on Polygon. UMA whale governance attack (March 2025) was voting-power concentration, not a selector-pattern exploit template deployment. Not in v1 monitoring scope.

RD-F-163 green Avg attacker reconnaissance time for peer-class protocols No documented pre-strike reconnaissance by attacker wallets against CTF Exchange contracts. UMA whale governance attack (March 2025, $7M Ukraine mineral market) was opportunistic — whale already held 25% of UMA voting tokens and voted; not a multi-day stealth reconnaissance pattern. CTF nonce-race exploit (Feb 2026 disclosure) was a protocol design observation by a researcher, not prior attacker reconnaissance. No peer-class prediction market incidents involve documented 78-day reconnaissance-before-strike patterns.

RD-F-165 green Protocol social channel has scam-coordinator flag No report of Polymarket's official Discord admin (discord.gg/polymarket) being flagged as a scam-coordinator. Phishing campaigns (Nov 2025) used comment-section injection in market pages, not Discord admin account compromise. No scam-coordinator on the curator watchlist is associated with the official Polymarket Discord.

Tooling / compiler / AI Green 13 5 of 5

RD-F-170 yellow Solc version used (known-bug versions flagged) ConditionalTokens (0x4D97DCd9...): Solidity 0.5.10 — EOL compiler but frozen deployment. Active bugs at 0.5.10 include 'ABIEncoderV2StorageArrayWithMultiSlotElement' (fixed in 0.5.10 — not applicable to 0.5.10 deployments). Post-0.5.10 bugs do not affect this frozen deployment. CTF Exchange V1 (0x4bFb41d5...): Solidity 0.8.15 — bugs 'DirtyBytesArrayToStorage' and 'InlineAssemblyMemorySideEffects' are FIXED in 0.8.15 (were in 0.8.13-0.8.14). V1 is sunset as of April 28, 2026. CTF Exchange V2, NegRiskCTFV2, pUSD: Solidity 0.8.34 — no known active bugs. Yellow assigned for presence of EOL 0.5.10 compiler in the dependency stack (ConditionalTokens), even though practical risk is minimal. RD-F-174 yellow Dependency tree uses EOL Solidity version ConditionalTokens (0x4D97DCd9...) uses Solidity 0.5.10 — EOL. This is a frozen deployed contract not receiving updates; the core V2 system uses Solidity 0.8.34 (current stable). The V2 dependency tree (solady, forge-std) uses only current/supported versions. Yellow for EOL Solidity in the frozen dependency.

RD-F-171 green Bytecode similarity to audited upstream with behavior deviation CTFExchange V1/V2 are original Polymarket development — no audited upstream to compare against. ConditionalTokens is verbatim Gnosis CTF with no behavioral deviation. No AI-copy risk pattern identified.

RD-F-172 green Repo shows AI-tool co-authorship in critical files Recent commits to ctf-exchange-v2 (SHA ccc0596, April 13, 2026) show no 'Co-authored-by' trailers mentioning GitHub Copilot or any AI tool. Commit authors: 0xrajath, mshrieve, JonathanAmenechi — standard human authorship.

RD-F-173 green Team self-disclosure of AI-generated Solidity No disclosure found in Polymarket blog, GitHub README, Twitter/X, or official documentation mentioning AI-generated Solidity in security-critical contract paths. Polymarket/agents repo (AI trading bots) is separate from smart contract codebase.

Response & disclosure hygiene Yellow 33 4 of 4

RD-F-176 red Disclosure SLA public No publicly stated acknowledgment-time SLA (e.g., 72h ack) found in the Immunefi program description or Polymarket docs. Immunefi's standard framework provides general guidance but Polymarket has not committed to a specific SLA. Template: red = no SLA published. RD-F-177 yellow Prior known-ignored disclosure Trust Security reported a UmaCtfAdapter frontrunning vulnerability via Immunefi in 2024. Polymarket responded: paid a $500 good-faith bounty, acknowledged the issue was already known internally (reported 3 months prior by another researcher), and explicitly chose not to fix the contract code — opting for private mempool mitigation and a future fixed adapter instead. The vulnerability was not subsequently exploited at scale. This is a known-ignored disclosure pattern (code not patched despite awareness). Yellow rather than red because: mitigations were applied and bounty was paid (not a complete ignore); the vulnerability was not exploited post-disclosure.

RD-F-175 green Disclosure channel exists Immunefi bug bounty program active at https://immunefi.com/bug-bounty/polymarket/ since April 22 2024, last updated January 24 2025. Immunefi Standard Badge awarded. Trust Security submitted a vulnerability in 2024 and received a $500 good-faith bounty, confirming the channel is operational. Disclosure channel exists and is functional.

RD-F-178 green CVE/GHSA advisory issued against protocol No CVE, GHSA, or equivalent public advisory found against Polymarket's smart contracts (CTF Exchange, UMA CTF Adapter, Conditional Tokens). Incidents documented via news articles and Discord statements, not formal advisories. No matching NVD or GHSA entry found. Scoring green.

rubric_version v1.7.0 graded_at 2026-05-12 04:38:07 factors 184 protocol polymarket