Market risk of a 51% attack on Polymarket

Over the past few days, I did a deep dive into Polymarket's implementation and the current state of the market. Here’s what I’ve found:

UMA is a cryptocurrency protocol that created a system to verify statement accuracy (e.g., 'Trump won the 2024 election'), which they call their 'Optimistic Oracle'. An 'Asserter' can post (assert) this information to the network, staking some cryptocurrency (any approved ERC20 token) alongside the assertion. Anyone who wants to dispute it (the 'Disputer') may do so, typically by matching the Asserter's stake. If a dispute happens, the process escalates to the 'Data Verification Mechanism' (DVM). When it reaches DVM, the tokenholders of UMA decide by vote how the assertion should resolve (i.e., ultimately whether the Asserter or the Disputer receives the staked currencies). They do this with one vote per UMA token.

Polymarket operates as a separate contract on the blockchain that interacts with UMA. The API allows users to create betting markets, bet on them, and perform various tasks. The Polymarket API also allows users to propose and dispute the outcomes of the betting markets when they end, costing about $750 to assert, and then another $750 to dispute. If there is a dispute, it gets escalated to UMA's DVM system. Disputes rarely happen because the DVM works. Typically, nobody has any incentive to lose their $750. This clever solution allows them to run a completely decentralized betting market that cannot be shut down.

However, the market cap of UMA is only about $200m as of writing this post. A 51% attacker would need to own approximately $100m worth of it. It is my understanding that any single person and/or collaborative group of people with such a quantity of UMA could then purchase and dispute one side of every contract on Polymarket, vote in favor of themselves during the DVM for each of them, and win every bet. Doing this would destroy their $100m of UMA, but they'll potentially make more from the bets.

A quick browse of Polymarket shows an order book with quite a few contracts readily available for purchase, many of them priced at 0.1 cents which can pay out $1 to an attacker (1000x). It's difficult to determine exactly how much an attacker could make on Polymarket because it depends on a lot of factors and a moving market. But a 51% attacker might attempt something like this on the "Presidential Election Winner 2024" market ( https://polymarket.com/event/presidential-election-winner-2024 ):

• Buy "Yes" on Chris Christie. $0.001. Buy 72 million shares right now for $72k.
• Buy "No" on Trump over a few weeks or months. $0.42. Maybe accumulate 100 million shares for $42m
• Buy "No" on Kamala over a few weeks or months. $0.58. Maybe accumulate 100 million shares for $58m
• Accept the loss of $100m worth of UMA due to the price collapsing

This would cost roughly $200m and make $272m. They could make a bit more on the smaller betting markets as well. There's only about $670m of USDC on the Polygon network in total, which puts a hard limit on how much money exists in these contracts.

At the moment, at least, someone on these markets betting that Chris Christie is 99.9% likely to lose is not correctly pricing in the risk of a 51% attack on UMA.

There is a different play for someone with a lot more money and power to 51% attack UMA, and that would be to gain favor with Trump by using their 51% to decide Trump wins on the betting markets. It could be used to help the publicity battle that Trump will fight if he doesn't clearly win the election.

I would guess there's not quite enough money to be made just yet to justify a risky, expensive attempt to do a 51% attack on UMA, in large part because acquiring the 51% over the last few years would have cost the attacker a lot more than $100m (see historic prices). If anyone already did this, they're probably planning to hold on for something bigger. I'd put a small non-zero chance on a malicious actor already having acquired 51%.

So, in conclusion, the current market seems to be teetering on the edge. If UMA's market cap doesn't rise as fast as Polymarket's betting markets, Polymarket may need to switch to a voting network that they have 51% control over, or some other system that can't be readily abused.

References:

https://docs.uma.xyz/protocol-overview/how-does-umas-oracle-work

https://learn.polymarket.com/docs/guides/markets/dispute/

https://www.coingecko.com/en/coins/uma