PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Polymarket: what can a third-party script do in a session?
A familiar supplier should be considered alongside the code actually delivered and the operations it can reach inside the page.
By Pentesty
Separate the incident from the proposed tests
In its October 30, 2026 account, Polymarket said a compromised external script used active sessions to sell positions and move funds on October 29. The statement includes $2.7 million in attack-related refunds; it does not establish that every payment has been completed.
In Hudson Rock’s static analysis, the code seeks the trading client and signer already present in the page. Researchers did not execute the sample or establish every path’s effectiveness. The exercises below are Pentesty proposals for an authorized environment.
Establish which bytes the browser receives
The SRI documentation explains checking a fetched resource against an expected hash, including CORS requirements for resources from another origin. For the exercise, choose an approved test file and record its content, version and integrity value before assessing browser behavior.
In a controlled preview, compare the approved delivery with a harmless modified copy. Record loading or rejection, the observed message and the legitimate operation that remains available. Also agree how an authorized update will change the file and its reference. If the integration cannot pin content, document that limitation and review another delivery or isolation approach with its owner.
Compare a new tab with one already open
Prepare two synthetic sessions: one started after the intervention and another kept open from before the change. Use only harmless instrumentation, test accounts and simulated destinations. Remove the integration in the authorized environment and observe what each session can still request. Record the served version, page state and the authorizing component’s decision separately.
Decide beforehand which sessions should be terminated and how to verify that outcome. Capturing a new page answers a different question from observing the earlier tab. Preserve the records needed to compare them while excluding credentials and personal data. The Magento observation workflow helps document browsing conditions; add the continuity of authenticated authority here.
Deliver an acceptance record others can repeat
Review the results with the application and business-process owners. An exception needs a justification, deadline and person responsible for resolving it. Record what continued working and which browser, authentication or integration combinations remained outside the sample.
Acceptance should connect the approved change to an observed outcome, with conditions for another test when the supplier, file or policy changes. A proposed record contains:
- Delivery: approved resource, observed version and integrity-test result.
- Session: initial state, permitted operation, rejected attempt and termination record.
- Decision: acceptance owner, assessment limits and outstanding work with a review date.
Frequently asked questions
Does SRI replace an application-permission review?
SRI checks whether the fetched file matches the expected content. Also record which operations the session can request and the conditions that authorize their execution.
Does a CSP that allows the supplier complete the assessment?
Examine the received policy and the exercise’s outcome. Declared origin, file integrity and reachable operations need separate evidence in the acceptance record.
What evidence should cover a tab that was already open?
Record its initial state, requests observed after the change and the effect of terminating the session. Identify combinations that were not exercised.
Are real wallets or funds required?
Plan an authorized workflow using synthetic accounts, data, destinations and actions. Agree with the owners on representative conditions and the limits of what the exercise can establish.
Sources and references
- Polymarket: October 29 incident statement
- Hudson Rock: static script analysis
- MDN: resource-content verification with SRI
Original Pentesty analysis, published November 1, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.