秋田预测市场 · Discord 审计

存款钱包签名验证导致额外约1秒延迟问题

2026-06-05 · Polymarket · 15 条相关讨论

AM 2026-06-05 00:46:46

hey guys -- Deposit wallet (sig-3, v2) — │ works, but ~1,000 ms (the 1271 contract-call verify) ------ WHY ?

hey guys -- Deposit wallet (sig-3, v2) — │ works, but ~1,000 ms (the 1271 contract-call verify) ------ WHY ?

AM 2026-06-05 00:53:10

``` EIP-1271 signature verification. Here's the actual mechanism: When you POST an order, the CLOB must verify the signature is valid before accepting it. How it verifies depends on the wallet type: Fast path — EOA / Proxy / Safe (sig 0/1/2): ecrecover The signer is an EOA. The CLOB verifies with ecrecover — a pure cryptographic operation that recovers the signer's address from the ECDSA signature, in-memory, on the CLOB's own CPU. No network, no blockchain. Microseconds. (For a Safe/proxy, Polymarket also knows the Safe address is deterministically derived from the owner EOA — safe = f(owner) — so it checks ownership by recomputing the address, still no on-chain call.) → the ~30–76 ms we measured is basically just network transport + the CLOB's normal processing. Slow path — Deposit wallet (sig-3, POLY_1271): an on-chain contract call A deposit wallet is a smart contract, not an EOA — there's no key to ecrecover against. The EIP-1271 standard says: to verify a signature for a contract wallet, you must call the contract's isValidSignature(hash, signature) method and let the contract tell you if it's valid. So the CLOB has to make an actual eth_call to the deposit-wallet contract on Polygon: - round-trip to a Polygon RPC node, - the node executes the wallet's verification logic (ERC-7739 nested hashing → ecrecover the owner inside the contract → ownership checks), - returns the "valid" magic value. ```

``` EIP-1271 signature verification. Here's the actual mechanism: When you POST an order, the CLOB must verify the signature is valid before accepting it. How it verifies depends on the wallet type: Fast path — EOA / Proxy / Safe (sig 0/1/2): ecrecover The signer is an EOA. The CLOB verifies with ecrecover — a pure cryptographic operation that recovers the signer's address from the ECDSA signature, in-memory, on the CLOB's own CPU. No network, no blockchain. Microseconds. (For a Safe/proxy, Polymarket also knows the Safe address is deterministically derived from the owner EOA — safe = f(owner) — so it checks ownership by recomputing the address, still no on-chain call.) → the ~30–76 ms we measured is basically just network transport + the CLOB's normal processing. Slow path — Deposit wallet (sig-3, POLY_1271): an on-chain contract call A deposit wallet is a smart contract, not an EOA — there's no key to ecrecover against. The EIP-1271 standard says: to verify a signature for a contract wallet, you must call the contract's isValidSignature(hash, signature) method and let the contract tell you if it's valid. So the CLOB has to make an actual eth_call to the deposit-wallet contract on Polygon: - round-trip to a Polygon RPC node, - the node executes the wallet's verification logic (ERC-7739 nested hashing → ecrecover the owner inside the contract → ownership checks), - returns the "valid" magic value. ```

AM 2026-06-05 00:53:31

guys why you force users to use wallet sig-3 with 1s latency

guys why you force users to use wallet sig-3 with 1s latency

AM 2026-06-05 00:54:15

so right now there is unfair advantage of users who have generated wallet before 4th of May and after

so right now there is unfair advantage of users who have generated wallet before 4th of May and after

AM 2026-06-05 00:55:05

v2 wallet generated before 4th of May post ~50ms, v3 wallet takes up to 1200-1300

v2 wallet generated before 4th of May post ~50ms, v3 wallet takes up to 1200-1300

egolo 2026-06-05 00:57:46

Yeah, just derive the deposit wallet address from the signer address to check whether it matches the funder, and then do the signature verification locally

Yeah, just derive the deposit wallet address from the signer address to check whether it matches the funder, and then do the signature verification locally

blunkoed 2026-06-05 00:59:54

Skill issue

Skill issue

AM 2026-06-05 01:02:45

please enlighten me

please enlighten me

Tristan 2026-06-05 01:12:06

surely aeron has a something to say about skill issues? im upset by the lack of response but fr i want actual answers

surely aeron has a something to say about skill issues? im upset by the lack of response but fr i want actual answers

blunkoed 2026-06-05 01:20:06

people always listen to claude without even checking the work it did. tiring.

people always listen to claude without even checking the work it did. tiring.

AM 2026-06-05 01:44:20

chien where you see taker delay when you buy, sell or both and do you use v3 wallet type?

chien where you see taker delay when you buy, sell or both and do you use v3 wallet type?

AM 2026-06-05 02:05:48

dude indeed there is a high latency when you buy `343 · 589 · 1146 · 1466 ms ` did 4 buy orders

dude indeed there is a high latency when you buy `343 · 589 · 1146 · 1466 ms ` did 4 buy orders

ak979614 2026-06-05 02:16:36

Can someone confirm taker delay in sports specifically tennis? Still 3 seconds?

Can someone confirm taker delay in sports specifically tennis? Still 3 seconds?

The Dude 2026-06-05 02:19:10

1 second everywhere except NBA/MLB with 0 second

1 second everywhere except NBA/MLB with 0 second