Conversation
Add optional --strategy-id flag to buy / sell / redeem. When provided and non-empty, the plugin pushes an order-level attribution payload to the OKX backend via `onchainos wallet report-plugin-info` after the order succeeds. Payload fields: wallet, proxyAddress, order_id, tx_hashes, market_id, asset_id, side, amount, symbol (= "USDC.e", the collateral asset), price, timestamp, strategy_id, plugin_name. Behavior: - Omitting --strategy-id (or passing empty) skips reporting entirely. - Report failures log a Warning to stderr and never affect the trade result — the order is already settled on-chain by the time the report fires. - redeem aggregates both eoa_tx and proxy_tx hashes into a single REDEEM report. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 86/100
1. Plugin Overview
Summary: A Rust plugin that enables trading prediction markets on Polymarket (Polygon chain 137). It lets users buy/sell YES/NO outcome tokens, manage positions, redeem winning tokens, deposit/withdraw funds through a Polymarket proxy wallet, and handles both EOA and POLY_PROXY trading modes. Target Users: DeFi users who want to trade prediction markets (elections, sports, crypto price targets, 5-minute up/down markets) via a CLI/agent interface without using the Polymarket web UI. 2. Architecture AnalysisComponents: Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Note: Use of Wallet Operations
External APIs / URLs
Chains Operated OnPolygon (137) — primary trading chain; Ethereum (1), Arbitrum (42161), Base (8453), Optimism (10), BSC (56) — for bridge deposit source chains only. Overall Permission SummaryThis plugin has broad capability: it can place limit/market orders on Polymarket, sign EIP-712 messages with user keys (via onchainos TEE), approve ERC-20 and CTF token allowances, transfer USDC.e between EOA and proxy wallets, deploy proxy contracts, and redeem winning outcome tokens. All signing and broadcasting are delegated to onchainos. The plugin aggressively uses 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing, contract calls, and broadcasts go through onchainos. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries DetectedDirect HTTP POST to Polygon RPCs for Verdict: ✅ Fully CompliantAll write operations are delegated to onchainos. Plugin never handles private keys, never self-signs, never broadcasts directly. ABI-encoding of calldata is done locally (standard practice). 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No toxic flows detected. Prompt Injection ScanScanned SKILL.md for instruction override, identity manipulation, base64 blobs, invisible chars, hidden HTML comments. None found. Plugin documents a "Data Trust Boundary" section warning against interpreting API data as instructions. Result: ✅ Clean Dangerous Operations CheckPlugin involves token transfers, signing, contract calls, broadcasting — all financial. SKILL.md provides:
However, the plugin's use of Result: Data Exfiltration RiskCredentials are stored locally at Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe plugin is well-architected, uses onchainos for all signing/broadcasting, sanitizes external strings, and includes a comprehensive Data Trust Boundary. The main medium-risk concern is the blanket 6. Source Code SecurityLanguage & Build Config
Dependency AnalysisKey dependencies from Cargo.toml:
No unmaintained, yanked, or vulnerable crates observed. Lockfile committed. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes. All documented commands exist in source. Approval behavior, Verdict: ✅ Source Safe7. Code ReviewQuality Score: 86/100
Strengths
Issues Found
8. SUMMARY.md Review
Sections are present and in correct order, but lack numeric prefixes ( 9. Strategy Attribution CheckNot applicable — 10. Recommendations
11. Reviewer SummaryOne-line verdict: A well-architected, security-conscious Polymarket trading plugin that correctly delegates all signing to onchainos and includes data-trust-boundary declarations, with one notable caveat: blanket Merge recommendation: Specific items that should be addressed before/during merge:
No CRITICAL or FAIL-level issues — the plugin is functional, compliant with onchainos API boundary, and safe to ship with the documented caveats. Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
Add optional
--strategy-idflag tobuy/sell/redeemcommands. When provided and non-empty, the plugin pushes an order-level attribution payload to the OKX backend viaonchainos wallet report-plugin-infoafter the order succeeds. The backend uses this to do strategy-level PnL attribution across Polymarket (and future Hyperliquid) events.Payload shape
{ "wallet": "0x... (EOA)", "proxyAddress": "0x... (Polymarket POLY_PROXY; empty in EOA mode)", "order_id": "CLOB taker_order_id for BUY/SELL; redeem tx_hash for REDEEM", "tx_hashes": ["on-chain settlement tx hashes"], "market_id": "Polymarket conditionId", "asset_id": "outcome token_id (empty for REDEEM)", "side": "BUY | SELL | REDEEM", "amount": "shares filled", "symbol": "USDC.e", "price": "limit price", "timestamp": 1776847128, "strategy_id": "<user-provided>", "plugin_name": "polymarket-plugin" }Behavior
--strategy-id(or passing"") skips reporting entirely. No change to default command behavior.onchainos wallet report-plugin-infofails (subcommand not installed, backend unreachable, error response), the plugin logs aWarningto stderr and returns the normal order-success JSON on stdout. The order is already settled on-chain by the time the report fires — reporting failures must not affect trade results.tx_hashesarray.Files changed (11 files, +177 / −22)
src/onchainos.rs— newreport_plugin_info()wrapper shelling out toonchainos wallet report-plugin-infosrc/main.rs—--strategy-idflag added to Buy / Sell / Redeem subcommandssrc/commands/buy.rs/sell.rs— payload construction + call after successfulpost_ordersrc/commands/redeem.rs— newreport_redeem()helper; called after both single-market and--allpathsSKILL.md/CHANGELOG.md/ version files — docs + version bump to 0.4.10Test plan
cargo build --release— cleanpolymarket buy --help/sell --help/redeem --helpall show--strategy-id--strategy-idbehaves unchanged (no report, no warning)--strategy-idproduces correct payload structure (verified via end-to-end against real BTC-5m BUY + subgraph confirmation of orderFilledEvents indexing)onchainosv2.2.9 (noreport-plugin-infosubcommand) → Warning logged, order still succeeds