Li.Fi protocol exploited for $11.6M after human error in deploying smart contract facet

Following the $11.6 million exploit of the Li.Fi protocol, an API used to bridge and swap digital assets across blockchains, the Li.Fi team released

An exploit of the Li.Fi protocol resulted in the theft of $11.6 million in digital assets, prompting the Li.Fi team to release an update on the technical aspects of the breach.

The breach occurred during the deployment of a new smart contract facet, which contained a vulnerability that enabled users calling the smart contract to initiate calls to any contract without prior validation.

This function stemmed from code taken from the LibSwap library, which facilitates calls between decentralized exchanges, service providers, and clients to coordinate the asset bridging and swapping processes.

Normally, these calls are screened against whitelisted addresses to ensure validation. However, human error in deploying the offending smart contract facet resulted in these checks being bypassed, rendering the protocol vulnerable to exploitation.

The Li.Fi team confirmed that the attack occurred on the Ethereum and Arbitrum networks and affected 156 wallets that had the “infinite approvals” option turned on. Those who did not enable this option were not affected by the exploit.

In statements to Cointelegraph, spokespeople for Li.Fi said they contained the exploit, addressed the critical vulnerability, and contacted the proper law enforcement authorities to trace the stolen funds. At the time of this writing, the issue has been fixed, and Li.Fi is operating normally.

Related: Lazarus is moving millions from $305M DMM Bitcoin hack — ZachXBT

This is not the first time that a vulnerability in the Li.Fi protocol has been exploited. In March 2022, a similar exploit affected users who had the “infinite approval” option turned on, allowing hackers to drain $600,000 from the protocol from 29 wallets before the vulnerability was addressed.

The protocol was quick to reimburse investors for their losses, refunding 24 wallets directly from its treasury and offering the remaining five wallets a voluntary compensation plan akin to that received by early angel investors of Li.Fi.

Crypto hacks put the damper on the industry in 2024

Hacks and exploits continue to plague the crypto industry and the decentralized financial sector, in particular.

A recent report from security firm Cyvers showed that 2024 losses from crypto exploits are nearing $1.4 billion, driven primarily by phishing attacks, and have risen sharply since 2023.

Magazine: Best and worst countries for crypto taxes — plus crypto tax tips