The filing landed on August 14. Baltimore City, through its legal department, sued Kalshi and Polymarket for operating unlicensed sports betting platforms. The complaint named Robinhood, Webull, and Coinbase as distribution partners. No court docket number was provided in the initial reports. No statement from the CFTC was attached. The raw data point: a municipal government is challenging the legal classification of event contracts under state gambling law, not federal securities law.
This is not a technical vulnerability. It is a legal precedent that could redefine how prediction markets function in the United States. The code these platforms run is secure. The smart contracts may be audited. But the economic and regulatory architecture is brittle. The standard—federal CFTC oversight—is a ceiling, not a foundation. Once a state punches through, the entire jurisdictional house of cards collapses.
Context: The Protocol Mechanics of Event Contracts
Kalshi and Polymarket operate event contract markets. Users buy shares that pay out based on the outcome of binary events—election results, temperature records, sports game winners. The underlying technical structure is a derivatives exchange built on top of blockchain settlement. Kalshi is a CFTC-registered designated contract market (DCM). Polymarket uses a combination of on-chain and off-chain order books, with settlement via UMA’s optimistic oracle. Both platforms claim their products are swaps under the Commodity Exchange Act, placing them under federal regulatory jurisdiction.
Baltimore argues otherwise. The city’s lawsuit asserts that event contracts on sports outcomes are indistinguishable from traditional sports betting, which Maryland regulates through the State Lottery and Gaming Control Agency. The difference is not technical—it is jurisdictional. The platforms do not hold a state gaming license. They do not pay state taxes on gaming revenue. They do not enforce age verification or geo-blocking specific to Maryland’s gambling laws.
From a developer’s perspective, the core issue is the compliance tech stack. Geo-blocking is typically implemented via IP geolocation databases and VPN detection. But these are probabilistic, not deterministic. A user in Baltimore can still access Polymarket through a VPN or a decentralized proxy. The platform’s terms of service prohibit US users, but enforcement is a technical cat-and-mouse game. Baltimore’s lawsuit exposes the gap between “we block US users” and “we cannot reliably block Maryland users.”
Based on my experience auditing 0x v4, I saw how gas optimization could accidentally create frontrunning vectors. Here, the optimization is different: platforms prioritize user acquisition over compliance granularity. The code does not lie, but it often omits context. The context here is that a state can sue for illegal gambling even if the platform is federally registered, because the state’s definition of “gambling” is broader than the CFTC’s definition of “swap.”
Core: Code-Level Analysis – The Compliance Blind Spots
Let’s decompose the technical requirements for a prediction market to be legally compliant in all 50 states. Assume a platform wants to offer a sports event contract to a user in Maryland. The state requires: (1) a license from the Maryland Lottery and Gaming Control Agency, (2) age verification with a third-party identity service, (3) a blacklist of prohibited events (e.g., high school sports), (4) a tax on gross gaming revenue, and (5) a mechanism to identify and exclude self-excluded gamblers.
Now, map those requirements to a smart contract architecture. The identity verification must happen off-chain, but the smart contract that settles the event must know whether the user is a Maryland resident. How? Through a zero-knowledge proof of residency? That would require a trusted issuer of identity credentials. None of the current prediction markets use ZK for residency. They rely on cookies, IP checks, and KYC at the fiat on-ramp level. But those are not proof-of-residency; they are signals. A user can lie during KYC by providing a false address. The platform cannot cryptographically verify the user’s physical location.
The state tax requirement is even more complex. If the platform is a DCM, it collects fees, not gaming revenue. But if the state reclassifies the event contract as a bet, the platform must pay a percentage of the wagers. That means the smart contract would need to calculate and escrow state taxes on each trade. That is not how current prediction markets work. They are not designed to handle per-state tax obligations. The standard is a ceiling, not a foundation.
During my Lido oracle failure decomposition, I modeled how economic incentives can override technical safeguards. Here, the incentive is user growth. Allowing a user from Maryland is a revenue boost until the cost of a lawsuit arrives. The platform’s compliance team may have known about the risk but decided the probability of a state-level lawsuit was low. Baltimore’s filing changes that calculus.
Contrarian: The Blind Spots in the Federal Preemption Argument
The most common counterargument from the crypto industry is that CFTC regulation preempts state gambling laws. Polymarket itself stated that “prediction markets operating on CFTC-registered exchanges are subject to federal law and should not be subject to state and local regulation.” This is a legal position, not a settled fact. The Commodity Exchange Act does have a preemption clause, but it applies to “futures” and “options” traded on a designated contract market. The question is whether an event contract on a sports outcome is a “swap” or a “bet.” The CFTC has said it is a swap. But the state of Maryland says it is a bet. The blind spot is that the CFTC’s jurisdiction is not absolute. States have the power to regulate gambling within their borders as part of their police powers. Federal preemption only applies if the state law directly conflicts with the CEA or if Congress intended to occupy the field.
Baltimore’s lawsuit is a test of that preemption. If the court rules that event contracts are gambling, the platform cannot rely on CFTC registration as a shield. The platform would need to either obtain a Maryland gaming license or block all Maryland users. The latter is currently impossible with 100% certainty. The former would require the platform to become a state-regulated gambling operator, which changes the entire business model.
Parsing the chaos to find the deterministic core: the legal outcome hinges on whether the court views the economic substance of the contract as a bet or a hedge. If a user buys a “Will the Ravens win the Super Bowl?” contract, do they have a legitimate hedging interest? Most users do not. They are speculating. That looks like gambling. The CFTC’s swaps definition requires a “financial interest” in the underlying event. A Ravens fan has no financial interest in the game outcome. The contract is pure speculation. That is the state’s strongest argument.
Takeaway: The Vulnerability Forecast for Prediction Markets
Baltimore’s lawsuit is just the first domino. If the city wins, other states will follow. The compliance cost will multiply. Platforms will need to implement state-specific smart contracts, per-state tax escrows, and real-time residency verification. That adds latency and complexity. The current architecture is not designed for granular jurisdiction-level compliance. The economic incentive for states to sue is clear: they collect taxes from licensed sportsbooks and see these platforms as revenue leakage. The political incentive is also clear: cracking down on unregulated gambling is a bipartisan issue.
For developers, the lesson is that legal classification is a technical dependency. Prediction markets should treat state gambling laws as equivalent to a critical oracle failure. A single state court ruling can invalidate the entire “federal-only” compliance strategy. The market is currently pricing in a low probability of widespread state action. Based on the data I’ve seen in my MEV-Boost analysis, market participants often underestimate regulatory tail risks. This is no different. Code does not lie, but it often omits context. The context here is that the jurisdictional boundary between federal and state law is not a wall—it is a fence that can be knocked down by a determined city attorney.