秋田预测市场 · Discord 审计

CLOB 队列非 FIFO 及签名时间戳漏洞

2026-06-18 · Polymarket · 7 条相关讨论

parameter 2026-06-18 04:49:15

The CLOB queue is RANDO not FIFO

The CLOB queue is RANDO not FIFO

JohanWalem 2026-06-18 15:00:16

Is this confirmed? I think theres something wrong with the queue position as well.

Is this confirmed? I think theres something wrong with the queue position as well.

JohanWalem 2026-06-18 15:05:56

For example there is a 100 share queue at 66c. I place a limit order for 1000. So the queue now increases to 1100 at 66c. Few seconds later more limits are placed and now the queue is 3000 shares at 66c. But clearly the new limit orders were placed several seconds after mine, so if the queue is FIFO then I should get filled before those limit orders get filled. Now 1000 shares fill before the price moves away. But I dont get any fill and all those filled at that level are those that entered the queue after my order. How does this even work

For example there is a 100 share queue at 66c. I place a limit order for 1000. So the queue now increases to 1100 at 66c. Few seconds later more limits are placed and now the queue is 3000 shares at 66c. But clearly the new limit orders were placed several seconds after mine, so if the queue is FIFO then I should get filled before those limit orders get filled. Now 1000 shares fill before the price moves away. But I dont get any fill and all those filled at that level are those that entered the queue after my order. How does this even work

LostGorilla 2026-06-18 16:23:33

the signed EIP-712 order timestamp has an effect on queue position at the same level

the signed EIP-712 order timestamp has an effect on queue position at the same level

Coolnyul 2026-06-18 16:35:57

is it a new exploit?

is it a new exploit?

Coolnyul 2026-06-18 16:47:03

So this is the queue jumping exploit people have been talking about?

So this is the queue jumping exploit people have been talking about?

Hundt 2026-06-18 17:43:05

someone knows how the queque bypass works? Possible to change time of ordertimestamp?

someone knows how the queque bypass works? Possible to change time of ordertimestamp?