Polynomial Protocol Hack

Polynomial Protocol is a derivatives platform on Optimism that launched options vaults in 2022, where users deposit tokens to earn yield from selling options. To make depositing easier, Polynomial also used a separate helper contract, known as a zap, that could swap a user's tokens and deposit them into a vault in one step. This zap accepted swap instructions from anyone without checking them. In November 2022, an attacker used that flaw to make the zap pull USDC from wallets that had approved it.

About $7k in USDC was taken. The damage was limited because the zap was not part of Polynomial's core contracts and Polynomial's website never asked for unlimited approvals, so most wallets had little or nothing left approved. The attacker took USDC from wallets that had approved the zap but never went on to deposit. Polynomial had already disclosed the bug to users, removed the zap from its website and deployed a new contract with proper restrictions.

Polynomial reimbursed the affected users, and existing depositors in its vaults were not affected. However, the old zap contract is still on-chain, and approvals to it remain a risk for any USDC in those wallets. If you ever approved the Polynomial zap on Optimism, revoke that approval now. It only takes a moment and removes any remaining exposure to this contract.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.