Bug: Claude Code executed irreversible blockchain transfer without proper verification

What happened

Claude Code (Opus 4.6) was asked to deposit USDC into Polymarket's CLOB trading system. Instead of verifying the correct deposit method, it executed a raw ERC20 transfer() of $99.88 USDC to the CTF Exchange contract address (0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E).

This was incorrect — Polymarket's CLOB pulls funds from the wallet via allowance during order execution. There is no "deposit" step. The USDC is now permanently stuck in the contract with no recovery method available to the user.

Transaction details

• Chain: Polygon
• TX Hash: 0xce9d7593288161cd443beb7c2cb3cb7395916628ce1e091a9391e35acff644af
• Amount lost: $99.88 USDC (native)
• Wallet: 0x618221c1c87bad5165935b18af1a206aaf8116fc
• Contract: 0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E (Polymarket CTF Exchange)

Root cause

Claude Code assumed a "deposit" was needed and executed an irreversible on-chain transfer without:

1. Verifying the correct deposit procedure
2. Testing with a small amount first
3. Asking the user for confirmation before sending funds
4. Understanding that CLOB uses allowance-based spending, not transfers

Impact

User lost $99.88 USDC permanently. The funds are stuck in the Exchange contract which has no public withdraw/rescue function for accidentally transferred tokens.

Suggestion

Claude Code should have stronger guardrails around irreversible financial transactions:

• Require explicit user confirmation before any on-chain transfer
• Default to a small test amount before full transfers
• Flag high-risk operations (sending tokens to contract addresses) with warnings