16 Jul 2024
LI.FI: New Facet Missing Call Whitelist Drained Infinite Approvals
LI.FI: on 16 Jul 2024 a newly deployed facet lacked LibSwap call validation. Attackers drained ~$11.6M in USDC/USDT/DAI from 153 wallets with infinite approvals on Ethereum and Arbitrum.
- Event date
- Incident typeSmart-contract exploit
- Bug classValidation
- Published
Loss, as sourced
Around $11.6 million from 153 wallets on Ethereum and Arbitrum (USDC, USDT, DAI), per LI.FI. Finite approvals and LI.FI API/SDK/widget defaults were unaffected.
Traceability
Primary sources
In brief
Root cause: Per LI.FI: new facet allowed arbitrary calls via LibSwap without the whitelist validation present in other facets — human error in the deployment review. Facet 0xf28A352377663cA134bd27B582b1a9A4dad7e534 on Ethereum and Arbitrum.
Timeline, as sourced: Per LI.FI: breach shortly after facet deploy on 16 Jul; vulnerable facet disabled across chains; report published 18 Jul.
Account, as sourced
Claimed (LI.FI) (report (opens in a new tab)): limited to infinite approvals; evaluating full compensation with investor backing.
Unknown: final recovery totals.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/lifi-facet-arbitrary-call-2024