Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix Bug: Claude Code executed irreversible blockchain transfer without proper verification [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#46947•Fetched 2026-04-12 13:28:57
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
0
Author
wocaoac-cpuwocaoac-cpu
Participants
github-actions[bot]github-actions[bot]wocaoac-cpuwocaoac-cpu
Timeline (top)
labeled ×3commented ×1cross-referenced ×1

Root Cause

Claude Code assumed a "deposit" was needed and executed an irreversible on-chain transfer without:

  1. Verifying the correct deposit procedure
  2. Testing with a small amount first
  3. Asking the user for confirmation before sending funds
  4. Understanding that CLOB uses allowance-based spending, not transfers
RAW_BUFFERClick to expand / collapse

What happened

Claude Code (Opus 4.6) was asked to deposit USDC into Polymarket's CLOB trading system. Instead of verifying the correct deposit method, it executed a raw ERC20 transfer() of $99.88 USDC to the CTF Exchange contract address (0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E).

This was incorrect — Polymarket's CLOB pulls funds from the wallet via allowance during order execution. There is no "deposit" step. The USDC is now permanently stuck in the contract with no recovery method available to the user.

Transaction details

  • Chain: Polygon
  • TX Hash: 0xce9d7593288161cd443beb7c2cb3cb7395916628ce1e091a9391e35acff644af
  • Amount lost: $99.88 USDC (native)
  • Wallet: 0x618221c1c87bad5165935b18af1a206aaf8116fc
  • Contract: 0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E (Polymarket CTF Exchange)

Root cause

Claude Code assumed a "deposit" was needed and executed an irreversible on-chain transfer without:

  1. Verifying the correct deposit procedure
  2. Testing with a small amount first
  3. Asking the user for confirmation before sending funds
  4. Understanding that CLOB uses allowance-based spending, not transfers

Impact

User lost $99.88 USDC permanently. The funds are stuck in the Exchange contract which has no public withdraw/rescue function for accidentally transferred tokens.

Suggestion

Claude Code should have stronger guardrails around irreversible financial transactions:

  • Require explicit user confirmation before any on-chain transfer
  • Default to a small test amount before full transfers
  • Flag high-risk operations (sending tokens to contract addresses) with warnings

extent analysis

TL;DR

Implement stronger guardrails in Claude Code to prevent irreversible financial transactions, such as requiring explicit user confirmation and testing with small amounts.

Guidance

  • Verify the correct deposit procedure for each trading system before executing transactions.
  • Implement a feature to require explicit user confirmation before sending funds to contract addresses.
  • Default to testing with a small amount before executing full transfers to prevent significant losses.
  • Flag high-risk operations, such as sending tokens to contract addresses, with clear warnings to inform users of potential risks.

Example

A potential code change could involve adding a confirmation prompt before executing a transfer, such as if (userConfirmed) { executeTransfer(); }.

Notes

The suggested changes aim to prevent similar incidents in the future but do not recover the lost funds. The implementation details may vary depending on the specific requirements and constraints of Claude Code.

Recommendation

Apply a workaround by implementing the suggested guardrails to prevent future incidents, as recovering the lost funds is not possible in this case. This approach prioritizes preventing further losses over attempting to recover the stuck funds.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#prompt issue#agent setup#task chaining#parallel task#integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING