Exceefy Percolator CLI

RT @ClawdisAI: Our Mythos agent ran a scan of Percolator CLI - looks pretty solid on @toly side! Nothing major: Bug in the STOXX/SOL kee…

Well, what sucks is that basically I’ve had both 4.8 and 5.5 spinning over and over and probing percolator for bugs for the last week and basically nothing, and within the first hour fable found what seems like a credible LOF in the engine. Nuts

I bet it won’t find any lof or dos bugs in percolator https://x.com/polymarketmoney/status/2064174573487058989

1/ percolator-prog: TradeCpi lets a taker force a position onto any margined LP who never signed the txs. The program trusts a "matcher consent" account to stand in for the LP - but that account is attacker-owned and writable, so you just write the bytes a real opt-in would. there's no engine-enfor

Found a neat Solana PDA footgun in the active percolator-meta TWAP path. The config PDA was already scoped by: ["twap_config", market, squads, coin_mint, percolator_program] …but the signer PDA used by TWAP was only scoped by: ["market-0-twap", market] That means two configs for the same market