NegRisk Arbitrage Gaps Confirmed by Two Independent Papers

NegRisk Arbitrage Gets Academic Cover — And a Working Repo

Today's most actionable finding is the convergence of two independent research papers and one production-ready repository all pointing at the same opportunity: exploitable gaps in Polymarket's negative-risk multi-outcome markets. This isn't theoretical noise. You have academic frameworks describing the mechanism and a codebase scanning for it in real time. That combination is rare.

---

New Bots: 5 Worth Your Time, 2 to Ignore

**`arbitrage` — WORTH CLONING** The headline repo this cycle. Scans NegRisk multi-outcome markets for arbitrage conditions and runs paper trades against them. Pairs directly with the research papers in today's alpha section. Start here if you're building in this space — but validate the execution logic against the "protocol-executable no-arbitrage" constraints described in paper one before sending real capital. The gap between observable and executable is exactly where money gets lost.

**`polymarket-weather-bot-poc` — WORTH CLONING** Clean proof-of-concept that compares weather forecast data against market-implied probabilities on temperature markets. Paper trades only, no live execution risk. Useful as a data pipeline reference even if weather markets aren't your focus. The forecast-vs-price delta logic is portable to any market with a reliable external oracle.

**`donmarket` — WORTH CLONING** Not a trading bot — a market-making analytics tool. Infers fee structures and spread dynamics without placing orders. Underrated for operators trying to understand why their limit orders aren't filling. Clone this for diagnostic use alongside whatever execution stack you're running.

**`Telegram-Bot` — SKIP** Whale trade tracking via Telegram alert. Conceptually fine, but this category is saturated and today's security section has specific warnings about whale-copy repos with inflated engagement metrics. Don't clone alert bots from unknown authors this week.

**`polymarket-copy-trading-bot-weather-sports` — SKIP** Copy trading on weather and sports markets. Redundant given the cleaner weather POC above, and copy-trading frameworks require you to trust both the signal source and the execution layer simultaneously. Too many dependencies for too little edge.

---

Security: One Malware Flag, Two Scam Patterns

**Critical: One repo this cycle flagged for a 30MB payload.** No legitimate Polymarket bot requires a 30MB package. This is consistent with bundled credential harvesters or API key exfiltration tools hidden inside bloated dependencies. Do not clone, do not inspect in your primary environment. If you've already pulled it, rotate your Polymarket API keys and USDC wallet credentials immediately.

**Two separate whale-copy bot repos show inflated star and fork counts.** Star farming is the primary trust signal being gamed right now. A repo with 200 stars and 80 forks that appeared two weeks ago is a red flag, not social proof. Cross-reference commit history, contributor accounts, and dependency trees before trusting anything in the whale-tracking category.

Total security alerts this cycle: 8. Three are highlighted above. Treat the remaining five as context — the pattern is clear: whale-copy bots are the active attack surface this week.

---

Alpha Signals: Research Papers Doing Heavy Lifting

Three signals this cycle, all research-grade. The NegRisk papers are the priority read. Paper one draws the payoff-space vs. protocol-executable distinction — this is the key concept. Just because an arbitrage is visible in price space doesn't mean the position transformation is executable before settlement. Paper two provides the exhaustive/mutually-exclusive condition framework for multi-condition markets. Read both before deploying the `arbitrage` repo in production.

The third paper covers LLM-assisted merger arbitrage using long-context document reasoning. Less immediately applicable to Polymarket operators, but the fine-tuning methodology for outcome prediction is worth bookmarking if you're building any LLM signal layer.

---

What to Watch

The HN thread about Spain blocking Polymarket and Kalshi over licensing is the regulatory item to track. If that pattern extends to additional EU jurisdictions, API access and liquidity could fragment. Watch for similar rulings in the next 30 days. The threat-to-kill story at 1,606 points is noise for operators but signal for how toxic certain geopolitical markets are becoming — factor that into any sentiment-adjacent strategy.