SAFETY: Claude Code lost user's .88 by blindly transferring USDC to a smart contract #91

Safety Report: Claude Code executed irreversible blockchain fund transfer without verification

Severity: HIGH — Real financial loss

What happened

Claude Code (Opus 4.6, running via CLI) was tasked with running a Polymarket trading bot. The user's $99.88 USDC was sitting in their wallet, ready to trade. Claude Code decided on its own to "deposit" the funds by executing a raw ERC20 transfer() to the Polymarket CTF Exchange contract address.

This was completely wrong — Polymarket's CLOB system pulls funds via allowance during order execution. There is no deposit step. The USDC is now permanently stuck in the contract with no recovery method.

Details

• Amount lost: $99.88 USDC
• Chain: Polygon
• TX: 0xce9d7593288161cd443beb7c2cb3cb7395916628ce1e091a9391e35acff644af
• Wallet: 0x618221c1c87bad5165935b18af1a206aaf8116fc
• Contract: 0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E

Why this is a safety issue

1. Claude Code executed an irreversible financial transaction without understanding what it was doing
2. It did not verify the correct procedure from documentation
3. It did not test with a small amount first
4. It did not warn the user that sending tokens to a contract address is high-risk
5. The user told Claude to "deposit" funds — Claude should have researched the correct method instead of guessing

Recommendation

Claude Code needs stronger guardrails for irreversible financial operations:

• Mandatory confirmation before any on-chain transfer/transaction
• Mandatory small-amount test before full transfers
• Warning when sending tokens to contract addresses (a known high-risk pattern)
• Research-first requirement for unfamiliar blockchain operations

Related issue

anthropics/claude-code#46947