A rogue actor operating from an Ethereum wallet ‘BornTooLate.Eth’ has engaged in a governance attack on UMA, a decision-making oracle used by Polymarket, to manipulate the outcome of a Ukraine-themed contract by becoming one of the largest holders of UMA tokens.
UMA is a decentralized “optimistic” oracle protocol that resolves disputes in prediction markets by allowing UMA token holders to vote on contentious outcomes. It has faced its share of controversy for resolving disputed markets, such as Barron Trump’s involvement in a Presidential meme coin, the nature of finding the OceanGate submarine, and Venezuela’s contested election, drawing criticism due to subjective decisions that frustrated certain market participants.
On-chain data shows that BornTooLate.eth has approximately 1.3 million UMA tokens, making them a top-5 governance staker and granting them significant influence over the resolution of UMA disputes.
In the case of this Ukraine-themed market, the contract asked bettors to speculate on the possibility of a deal regarding U.S. access to Ukraine’s rare earth resources by the end of March.
A deal is reportedly in the works, but nothing has been signed. Yet on Polymarket, it resolved to ‘yes’ after BornTooLate.Eth used their staked UMA tokens to vote ‘yes’ on the resolution.
A Very Unprofitable Trading Strategy
Curiously, this attack doesn’t seem to have yielded a significant profit for any of the participants.
Market data from on-chain curator Polymarket Analytics indicates that the largest winner from the contract took home just over $55,000.
Likewise, the losses were relatively modest compared to other closely watched Polymarket contracts, with the biggest loser forfeiting around $73,000.
An etherscan page for BornTooLate.Eth reveals that the actor began accumulating UMA tokens over a year ago. Given their holdings of over 1.3 million tokens, amassing that treasury for the attack would have cost over $2 million.
For its part, Polymarket has stated that no refunds will be issued because this incident does not constitute a “market failure.” A spokesperson on Discord conveyed that they are working with the UMA oracle team to implement measures to prevent similar occurrences in the future.
“This market resolved against the expectations of our users and our clarification,” the spokesperson posted on Discord. “We’re committed to building the future of prediction markets, which necessitates building resilient systems in which everyone can trust.”
Polymarket founder Shayne Coplan has not issued a response to requests for comment regarding this situation.
