Polynomial Protocol Hack

TOTAL LOST $7K
Low Other optimism

What happened

Quick Summary

The attacker could drain USDC balances of user addresses that approved their tokens to be spent by the PolynomialZap contract.

Details of the Exploit

The swapAndDeposit() function of the PolynomialZap contract contains a bug: there are no limitations for two input parameters - swapTarget and swapData. This allows anyone to abuse the function and steal tokens approved to the contact.

All tokens that are approved to the vulnerable contract are still in danger.

Block Data Reference

The vulnerable contract:

https://optimistic.etherscan.io/address/0xB162f01C…D77c82#code

The attack contract:

https://optimistic.etherscan.io/address/0xf682e302…4e29a8#code

Case & protocol details

Classification Other / Input Validation
Protocol Type Exploit/Other
Affected asset / contract -
Smart Contract Language Solidity
Official Website www.polynomial.fi/
Protocol Twitter/X @https://mobile.twitter.com/PolynomialFi

Evidence & learning

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

RetoSwap $2.7M
Particle Trade $142K
MINER $467K
Time $200K

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes