LowfieldLabs

The Second Blowup: Six Failure Modes the Audit Didn't Enumerate

2026-08-01 — Saga A: Paper vs. Live — Part 2 of 5

Saga A: Paper vs. Live — Part 2 of 5 By LowfieldLabs — dated kill decisions from the hypothesis ledger

The simulator said the strategy was worth millions. Version 3 of the paper sim, run on the same logic, reported $1.69M optimistic — and still $56K after a 5% queue-capture haircut, the conservative case we actually believed. On 2026-04-15, the day after the b27b blowup from Part 1, we turned on the live version. Roughly 22 closed bars later the wallet had gone from $514.14 to $261.06 — −$253.08 — and the postmortem listed six failure modes, five of which had no entry in any audit we had ever run.

That sequencing is the point of this piece. Part 1 ended with a five-step fill-model audit, formalized on 2026-05-12 from the b27b code, and presented it as the generalized defense against paper-live divergence. The eebd-replica blew up before that audit was written, with b27b’s raw lessons already applied — and every one of its failure modes would have sailed through the checklist anyway. The checklist was correct. It was also, on arrival, already incomplete. This is the postmortem of why, and the v2 that came out of it. The bot is dead, the wallet it replicated is dead, and nothing here touches anything currently traded.

The setup

The bot replicated a pseudonymous on-chain wallet (0xeebde7a0...) on Polymarket’s BTC five-minute bar markets. Where b27b was a one-sided maker ladder, the eebd strategy was a two-sided quoting-and-merge design, reverse-engineered from the wallet’s observed behavior:

The merge is the economic engine. On a binary market, one UP share plus one DN share merges into one dollar, so any pair acquired for less than $1.00 total is locked profit. The sim modeled this faithfully — faithfully enough to print $1.69M. What it did not model was the venue.

The bankroll, note, was the same money. The $514.14 left over after we killed b27b eight minutes into its live run became the eebd-replica’s opening balance. One wallet, two blowups, consecutive days.

Six failure modes, five of them new

The postmortem table is the core artifact. Each mode below gets the same treatment: what the sim assumed, what live did, the number.

1. Ghost-fill race on merge. The sim assumed that a fill is a fill — that once the CLOB reports your order matched, the shares are yours to merge. Live, the CLOB’s size_matched increments before the ERC1155 transfer settles on-chain. The bot saw the fill, fired a merge transaction against shares it did not yet hold on-chain, and the merge reverted with a SafeMath overflow. This one is Polymarket-specific and appears nowhere in the academic market-making literature we had read — which is precisely why no checklist anticipated it.

2. Last-trade reference bias. The sim assumed the tape is a fair reference price. Live, last_trade_price on complementary tokens both reflect the ask side, because taker prints cross the spread. The systematic consequence: tape_sum — UP tape plus DN tape, which should equal $1.00 on a binary pair — ran $1.02 to $1.04. Every bid pair the bot placed at tape − 1¢ was pre-priced at or above merge value. The structural entry cost was −$0.01 to −$0.04 per pair, compounding against every fill, before any adverse selection at all. The strategy’s profit condition was being violated by its reference price.

3. Merge-vs-ask race. The sim was synchronous: decide, act, next tick. Live v7 ran an async merge daemon with a 5-second sleep — and in those 5 seconds, the ask side of the quoting logic sold paired inventory out from under the merge that was about to fire. The inventory was in two buckets at once, merge-bound and ask-bound, and the two subsystems raced each other for it.

4. Min-size spam. The sim never rejected an order. Live, the CLOB enforces a 5-share minimum, and the bot’s ask logic posted int(qty_held) — which truncates below the minimum whenever inventory is small. Result: 98 rejected orders in a single bar. Not a losing trade — a bot shouting invalid orders at the venue, one bar long.

5. Stale imbalance gate. The v7 design included a 2× bid-imbalance gate meant to keep the two sides from filling in lockstep. Live, both sides filled in lockstep anyway and the gate never fired. A risk control that exists in the spec but not in the execution path is not a risk control; it is documentation.

6. Adverse selection in trending bars. This is the one mode marked reinforced rather than new — b27b had already died of it in Part 1. Every bar PnL was uniformly negative regardless of which side won the bar. The per-bar marks from v7: −$17.46, −$25.83, −$17.34, −$9.28. When the market trends, the side you get filled on is the side that is losing, and no amount of merge arithmetic rescues a portfolio that only accumulates the wrong half of the pair.

The final accounting included stranded residuals — 68 UP shares left over after the last SafeMath revert, more left on later bars after flatten — recoverable only on the venue’s settlement schedule, at values the bot no longer controlled.

The checklist, v2

Part 1’s five-step audit asked one question, five ways: does the paper fill condition match the live fill condition? The eebd-replica’s fill model was not the problem — its fills were real, its problem was everything around them. So the checklist grows. The original five steps stand unchanged; v2 appends:

Fill-Model and Execution Audit v2 — additions after eebd-replica

  1. Reconcile venue state against chain state before acting on it. If any downstream action (merge, transfer, redeem) depends on a fill being settled, verify the settlement, not the match report. A reported fill you cannot yet act on is a ghost.
  2. Validate your reference price, not just your signal. For any instrument with a structural identity — a binary pair’s tapes summing to $1.00 — assert the identity on live data before trusting the reference. If tape_sum prints $1.02–$1.04, your anchor is the bias, and every derived price inherits it.
  3. Enumerate the interleavings. Any async component touching shared state (a merge daemon, a slow settlement loop) races every other component that touches the same inventory. List the races on paper; assume the worst interleaving happens every bar.
  4. Dry-run the order stream against venue constraints. Minimum size, tick, precision — replay the bot’s intended orders through the venue’s validation rules before live. Ninety-eight rejections in one bar is a spec violation the sim could have caught, because the sim was the thing emitting the orders.
  5. Every unit of inventory, exactly one owner. Any share simultaneously eligible for two exit paths (merge-bound and ask-bound) will be taken by the wrong one at the wrong time. Partition inventory explicitly; assert the partition.

Note the shape of the additions. Steps 1–5 audited a model against a mechanism. Steps 6–10 audit an implementation against a venue: settlement timing, reference-price construction, concurrency, constraint validation, state ownership. That is the generalization this blowup bought for $253.08: the paper-live gap is not only a modeling gap. It is also the set of venue behaviors your simulator never had a reason to represent, because nothing in PnL accounting forces you to.

The architecture lessons are worth stating plainly, because they generalize past this bot. Synchronous decision logic, where the merge transaction blocks the loop, is correct for short-horizon binary markets — async daemons create races in 5-minute bars. Every share belongs in exactly one bucket. And never kill a bot mid-bar without an emergency-flatten path, because stranded inventory heading toward settlement is unrecoverable. The blowup also drove a reading directive we still hold: the interesting mechanism here is the merge, not the quoting — a convergence-arb problem — and the Avellaneda-Stoikov lineage we had been reading does not contain these failure modes at all.

The kill ledger

LowfieldLabs keeps a kill ledger: one dated page per hypothesis, including — especially — the ones that died. The count currently stands at 1,232 hypothesis pages, 15 proven. The eebd-replica’s page earns its keep the same way b27b’s did: once as a blowup, and once as the origin of checks 6 through 10 above. The checklist is now a living document. It will be wrong again, in a direction we have not traded yet, and when it is, there will be a Part in this saga for it.

In Part 3: the ground-truth reconstruction. The canonical blowup numbers from Part 1 — the paper profit, the live loss, the direction of the fill-model error itself — turn out to be measurement artifacts, and proving so required rebuilding the tape. The checklist survives. The numbers that motivated it do not.

This piece describes research methodology and historical experiments on dead systems. It is not financial advice.

Get the kill decisions by email