On February 8, 2022 Superfluid (money streaming protocol on Polygon) suffered an exploit of approximately $8.7 million via a vulnerability in the CTX (context) validation mechanism where the attacker injected a forged context containing an arbitrary sender address, allowing agreement contracts to execute transfers on behalf of other accounts.

The QI Vesting contract on the streaming digital asset protocol Superfluid has been exploited by an attacker by passing in incorrect call data. This vulnerability allows the attacker to transfer funds from Superfluid user wallets to Polygon and exchange them for ETH.