Polynomial Protocol Hack

Starting on November 18, 2022, an attacker drained about $7,000 in USDC from Optimism wallets that had approved Polynomial Protocol's zap contract, 0xB162f01C5BDA7a68292410aaA059E7Ce28D77c82. The zap was a helper that swapped a user's tokens and deposited them into Polynomial in one call. Its swapAndDeposit() function did not restrict the swapTarget and swapData inputs, so anyone could make the zap spend other users' approvals.

The attacker used contract 0xf682e302f16c9509ffa133029ccf6de55f4e29a8 to sweep USDC from users who had approved the zap but never deposited. Damage stayed small because Polynomial's interface never requested unlimited approvals. Polynomial had already disclosed the bug to its users and announced reimbursement for those affected a few weeks before the theft drew wider attention.

On December 12, 2022, a user publicly reported missing USDC, and Polynomial's statement that day put the loss at about $7,000, pointed back to its earlier reimbursement announcement, and asked everyone to revoke approvals to the old zap. Polynomial removed the zap from its website, but the vulnerable contract is still on-chain, so any approval left on it is still at risk.