LI.FI hack — July 2024

LI.FI, a cross-chain bridging and liquidity aggregator whose contracts also power the Jumper Exchange front end, was exploited on 16 July 2024. The attack targeted GasZipFacet, a module added to LI.FI's diamond contract five days earlier to let users top up gas on destination chains.

The facet's depositToGasZipERC20 function allowed a caller to make arbitrary calls with user-controlled data, without the whitelist checks present in every other facet. Security firm Decurity, whose finding CoinDesk cited on the day, identified this arbitrary-call path as the root cause. Anyone could therefore instruct the contract to pull tokens from any address holding an unlimited ERC-20 approval to it. Wallets using the finite approvals set by default by LI.FI's API, SDK and widget were not exposed. USDC, USDT and DAI were taken on Ethereum and Arbitrum.

The figures moved during the day. CoinDesk first reported roughly $8 million, then noted the project had revised the total to about $11 million. LI.FI's own incident report, published two days later, put the loss at about $11.6 million across 153 affected wallets, and that is the figure recorded here as the affected party's own accounting; Cointelegraph and Crypto Briefing both carried $11.6 million, though Cointelegraph counted 156 wallets rather than 153.

LI.FI disabled the vulnerable facet across all chains within hours and attributed its deployment to individual human error in overseeing the release process. It announced a voluntary compensation plan, backed by its investors, to reimburse 100 percent of affected users' funds. Cointelegraph noted that a March 2022 incident had similarly affected only wallets with infinite approvals enabled, costing about $600,000 across 29 wallets, which LI.FI also reimbursed.