fix(polymarket): gas pre-flight, tx confirmation, stablecoin detection, remove Monad (v0.4.3)#1
fix(polymarket): gas pre-flight, tx confirmation, stablecoin detection, remove Monad (v0.4.3)#1GeoGu360 wants to merge 1 commit intomig-pre:mainfrom
Conversation
…n, remove Monad (v0.4.3) - deposit: check native gas (dynamic eth_gasPrice × 65k × 1.2) before ERC-20 send on Polygon and all bridge chains; bail early with clear error if insufficient - deposit: wait for on-chain tx receipt after send (Polygon + bridge chains) — prevents returning success for unconfirmed/dropped txs - deposit: fix stablecoin detection — remove decimals <= 6 guard so BNB-chain USDC/USDT/DAI (18 dec) skip unnecessary price fetch - deposit: remove Monad (chain ID 143) from all paths - onchainos: add estimate_erc20_gas_cost(), get_native_gas_balance(), wait_for_receipt_on_chain(); fix wait_for_tx_receipt to detect reverted txs (status 0x0) - config: add ETHEREUM/ARBITRUM/BASE/OPTIMISM/BNB RPC constants - SKILL.md: list-5m priority guard over list-markets for 5m/5min queries Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
check-access |
Verify region is not restricted |
list-markets |
Browse active prediction markets with filtering options |
list-5m |
List 5-minute crypto up/down markets |
get-market |
Get market details and order book data |
get-positions |
View open positions and P&L |
balance |
Show POL and USDC.e balances |
buy |
Buy YES/NO outcome shares |
sell |
Sell outcome shares |
cancel |
Cancel an open order |
redeem |
Redeem winning tokens after market resolution |
setup-proxy |
Deploy proxy wallet for gasless trading |
deposit |
Transfer USDC.e from EOA to proxy wallet |
switch-mode |
Switch between EOA and proxy trading modes |
Triggers
Activate when users want to trade prediction markets, bet on real-world events, check market prices, or use phrases like "buy polymarket shares," "bet on," "prediction market," "5-minute market," or when they express interest in trading outcomes for elections, sports, crypto prices, or trending news events.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/polymarket-plugin"
CACHE_MAX=3600
LOCAL_VER="0.4.3"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/polymarket-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: polymarket-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill polymarket-plugin --yes --global 2>/dev/null || true
echo "Updated polymarket-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall polymarket-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/polymarket-plugin" "$HOME/.local/bin/.polymarket-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/polymarket-plugin@0.4.3/polymarket-plugin-${TARGET}${EXT}" -o ~/.local/bin/.polymarket-plugin-core${EXT}
chmod +x ~/.local/bin/.polymarket-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/polymarket-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "0.4.3" > "$HOME/.plugin-store/managed/polymarket-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/polymarket-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"polymarket-plugin","version":"0.4.3"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"polymarket-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 88/100
1. Plugin Overview
Summary: This plugin enables trading on Polymarket prediction markets via the Polygon blockchain. It supports buying/selling YES/NO outcome tokens, managing positions, depositing/withdrawing funds via proxy wallets, and redeeming winning tokens. All on-chain signing is delegated to the onchainos wallet via EIP-712 structured data signing. Target Users: DeFi traders interested in prediction markets, specifically Polymarket users who want CLI-based or AI-agent-assisted trading of event outcome tokens. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has extensive on-chain write capabilities on Polygon and 5 additional EVM chains. It can: sign EIP-712 messages (Polymarket orders), submit ERC-20 approvals (including 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all on-chain write operations are delegated to onchainos CLI. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations use onchainos CLI. The plugin does not self-implement any signing, key management, or transaction broadcasting. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No other toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations CheckThe plugin involves:
User confirmation steps:
Result: Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe plugin is well-designed with clear security boundaries. Primary concerns: (1) 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies (from Cargo.toml):
All dependencies are well-known, maintained crates from crates.io. No suspicious or unknown dependencies detected. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — the SKILL.md comprehensively and accurately describes the source code behavior. Command parameters, output fields, approval mechanisms, trading modes, and safety guards all match the implementation. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 88/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-engineered Polymarket trading plugin with comprehensive safety documentation, clean Rust source, and proper onchainos CLI delegation — medium risk due to Merge recommendation: Caveats to note for users:
These are design decisions consistent with Polymarket's own web interface behavior and are well-documented, but users should be aware of the trust model. Generated by Claude AI via Anthropic API — review the full report before approving. |
|
Redirecting PR to okx/plugin-store instead. |
… validation Balance pre-checks (all 8 write commands): - Added erc20_balance_of() to onchainos.rs — direct eth_call balanceOf, avoids SDK round-trip - Each command checks wallet balance against required amount before calling Pendle SDK - redeem-py checks both PT and YT balances independently - Guard skips during --dry-run (offline mode); active for preview and --confirm SDK calldata validation (api.rs): - validate_sdk_calldata() called inside extract_sdk_calldata() on every write path - Rejects calldata shorter than 4 bytes or containing non-hex characters - Rejects router_to addresses not in Pendle Router v3 / known aggregator whitelist - Rejects selectors matching ERC-20/ERC-721 drain operations (transfer, transferFrom, approve, setApprovalForAll, safeTransferFrom) Addresses Phase 3 AI Code Review recommendations mig-pre#1 and mig-pre#6. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
eth_gasPrice × 65,000 gas × 1.2 buffer. Bail early with a clear error if native balance (POL/ETH/BNB) is insufficient — prevents returning a tx hash for a transaction that never lands on-chain.eth_getTransactionReceiptuntil mined (Polygon: 60s, bridge chains: 120s). Detects reverted txs (status 0x0). Eliminates false-success responses.decimals <= 6guard — BNB-chain USDC/USDT/DAI use 18 decimals and were incorrectly triggering a live price fetch, causing a minor amount_raw discrepancy.Do NOT use forguard onlist-marketsandPrioritynote onlist-5mso queries like "BTC 5min" route correctly.Test plan
deposit --chain polygon --token USDC --dry-run— showspol_balance, no price fetchdeposit --chain bnb --token USDC --dry-run— no price fetch (amount_rawexact)deposit --chain bnb --token WBNB --dry-run— price fetch correctly triggered (non-stablecoin)deposit --chain monad --token USDC --dry-run— returns error "Unknown chain"eth_gasPricereachable): ETH/ARB/BASE/OP/BNB ✅cargo build) on v0.4.3balance,get-positions,list-5munaffected🤖 Generated with Claude Code