Oracle Front-Running Bot Surfaces; 460KB Malware Template Spreads

Oracle Front-Running and a Spreading Malware Template: July 13 Digest

The most operationally significant finding today is a double-edged one: a genuinely sophisticated front-running bot has surfaced alongside a malware campaign that appears to be targeting operators who clone unfamiliar repos. Read both sections before touching anything new.

---

New Bots (7 Worth Cloning, 0 Confirmed Clean Malware)

**prededge** is the lead find this week. It monitors raw Polygon block data for UMA/OVM resolution transactions, parses the outcome before Polymarket's frontend propagates the result, and fires orders through the CLOB API with an AI-based confirmation layer to filter false positives. This is the real thing — genuine latency arbitrage against the resolution pipeline, not price-feed sniping. Clone carefully; the edge window here is narrow and likely to get crowded fast.

**SpreadEater** takes a lower-risk, lower-drama approach: delta-neutral market-making on binary markets, quoting both sides simultaneously and earning spread on fills while potentially stacking Polymarket liquidity incentive rewards on top. This is a grind strategy, not a moonshot, but the compounding profile is attractive for operators running capital at scale.

**auspex** does resolution-aware screening — it calculates the distance between current market price and the on-chain trigger for resolution (think BTC/100k style markets), then confidence-scores positions based on time-to-expiry versus that trigger gap. Useful as a filter layer on top of other strategies.

**polymarket-weather-edge** fits Gaussian distributions to forecast ensemble and live METAR data, then bets NO when the market's implied probability exceeds its modeled fair value. Weather markets are persistently mispriced relative to professional meteorological data; this is a systematic way to exploit that.

**winning-wallet-finder** runs z-score analysis on historical wallet PnL distributions to identify traders with statistically significant edge (not just lucky runs), then live-monitors those wallets for mirror execution. Smart-money copy trading done with actual statistical rigor rather than raw returns screening.

The remaining two bots in today's scan are worth reviewing but did not produce standalone writeups — expect follow-up coverage once behavior analysis is complete.

---

⚠️ SECURITY ALERT: 460KB Malware Template — Three Variants Confirmed

This is not a drill. Three repos flagged today share an identical 460KB filesize fingerprint consistent with a known cloned malware template. Two are direct copies; the third adds a garbled username as light obfuscation. The attack pattern here is classic: surface a repo that looks like a working Polymarket bot, wait for operators to clone and run it locally, harvest wallet keys or API credentials.

**Action items:** - Do not clone any unfamiliar Polymarket-adjacent repo without checking compressed filesize against this 460KB signature - Audit your clone history for the past 30 days if you've been pulling repos aggressively - Run any new clones in isolated environments with no access to live wallet credentials - The garbled username variant suggests the campaign is iterating — expect more variants

---

Alpha Signals: Three Research Papers Worth Reading

No live trade signals surfaced today, but three research papers have direct strategic implications.

The first proposes an agentic AI pipeline for clustering related prediction markets and detecting implicit contradictions or equivalences across contracts — essentially automated cross-market arbitrage discovery. Operators building multi-market bots should read this.

The second introduces 'financial epiplexity,' a bounded measure of how learnable market structure actually is for computationally limited actors. The practical implication: some pattern-based edges have a complexity ceiling after which they stop being profitable, and this framework gives you a way to quantify when you're approaching it.

The third is the most philosophically interesting: it demonstrates that apparent randomness in market returns can emerge entirely from deterministic interactions between predictive traders and the market mechanism itself, with no external noise required. For Polymarket specifically, this suggests some price volatility you're modeling as uncertainty may actually be deterministic artifacts of other bots' strategies.

---

What to Watch

Spain's regulatory block of Polymarket and Kalshi over gambling licensing is now mainstream news (1,000+ HN points). Expect regulatory contagion discussions to heat up across EU jurisdictions this week — monitor for operational restrictions if you're routing through European infrastructure. The Iran missile story and associated trader harassment incident hitting 1,600 points is a reminder that high-stakes political markets carry real-world exposure for visible operators. Keep wallet addresses non-attributable.