There is a loophole in an old contract of the derivatives agreement Polynomial Protocol, and some assets of users who have approved the contract have been stolen

There is a loophole in an old contract of the derivatives protocol Polynomial Protocol on Optimism, in which the swapAndDeposit() function has no restrictions on input. Anyone can pass in an address and maliciously construct swapData to steal contract-approved tokens. The attacker deployed a contract to steal USDC through this vulnerability. Although the contract is no longer used, users who once approved the contract are still at risk of being stolen. Polynomial Protocol team members replied that the problem has been resolved and a new contract has been deployed, and users who have received losses can claim in Discord.