A rogue actor, known under the Ethereum wallet name ‘BornTooLate.Eth’, has orchestrated a governance attack on UMA, an oracle protocol used by Polymarket. This manipulation targeted a Ukraine-themed contract by leveraging their position as one of the largest stakeholders in UMA tokens.
Understanding UMA: An Overview of Its Role
UMA (Universal Market Access) is a decentralized oracle protocol designed to resolve disputes in prediction markets. It allows UMA token holders to vote on contentious outcomes, making it a crucial component for the functioning of platforms like Polymarket. However, the protocol has not been without controversy. It has faced scrutiny for its decisions in high-profile markets, such as those involving Barron Trump’s presidential meme coin, the OceanGate submarine incident, and Venezuela’s contentious elections. Critics argue that the subjective nature of these resolutions often frustrates market participants.
The Rise of a Rogue Actor
Recent on-chain data reveals that the wallet ‘BornTooLate.Eth’ holds approximately 1.3 million UMA tokens, positioning it among the top five governance stakers within the UMA ecosystem. This significant holding grants the actor substantial influence over the resolution of disputes within the platform.
The Ukraine-Themed Market Contract
The targeted contract related to speculation on whether a deal would be signed granting U.S. access to Ukraine’s rare earth resources by the end of March. While reports suggest negotiations are ongoing, no formal agreement has been reached. Despite this, the contract on Polymarket resolved with a ‘yes’ vote, influenced by the voting power of ‘BornTooLate.Eth’.
The Cost of Governance Manipulation
Interestingly, this governance attack appears to have resulted in minimal financial gain for the participants involved. According to market analytics from Polymarket, the largest winner from the Ukraine-themed contract earned just over $55,000. In contrast, the biggest loser incurred a loss of approximately $73,000, which is relatively moderate compared to other well-monitored contracts on the platform.
A Long-Term Strategy
The etherscan page for ‘BornTooLate.Eth’ indicates that the actor has been accumulating UMA tokens for over a year. With over 1.3 million tokens amassed, the effort to build such a treasury for the attack would have required an investment of more than $2 million.
Polymarket’s Response to the Attack
In light of the situation, Polymarket has stated that no refunds will be issued, asserting that this incident does not constitute a “market failure.” A spokesperson for the platform emphasized their commitment to collaborating with the UMA oracle team to prevent similar occurrences in the future. “This market resolved against the expectations of our users and our clarification,” the spokesperson shared on Discord. “We’re dedicated to building the future of prediction markets, which necessitates creating resilient systems that everyone can trust.”
Polymarket founder Shayne Coplan has not yet responded to requests for further comments regarding this incident.
