Li.Fi 協定因部署智慧合約方面的人為錯誤而被利用，損失達 1,160 萬美元

在 Li.Fi 協議（一種用於跨區塊鏈橋接和交換數位資產的 API）被利用 1,160 萬美元之後，Li.Fi 團隊發布了

An exploit of the Li.Fi protocol resulted in the theft of $11.6 million in digital assets, prompting the Li.Fi team to release an update on the technical aspects of the breach.

Li.Fi 協議的漏洞導致 1,160 萬美元的數位資產被盜，促使 Li.Fi 團隊發布了有關此漏洞的技術方面的最新資訊。

The breach occurred during the deployment of a new smart contract facet, which contained a vulnerability that enabled users calling the smart contract to initiate calls to any contract without prior validation.

該漏洞發生在部署新的智能合約方面時，其中包含一個漏洞，使調用智能合約的用戶能夠在未經事先驗證的情況下發起對任何合約的調用。

This function stemmed from code taken from the LibSwap library, which facilitates calls between decentralized exchanges, service providers, and clients to coordinate the asset bridging and swapping processes.

該函數源自於 LibSwap 庫的程式碼，該程式庫促進去中心化交易所、服務提供者和客戶端之間的調用，以協調資產橋接和交換過程。

Normally, these calls are screened against whitelisted addresses to ensure validation. However, human error in deploying the offending smart contract facet resulted in these checks being bypassed, rendering the protocol vulnerable to exploitation.

通常，這些呼叫會根據白名單位址進行篩選，以確保驗證。然而，部署有問題的智慧合約方面的人為錯誤導致這些檢查被繞過，使協議容易受到利用。

The Li.Fi team confirmed that the attack occurred on the Ethereum and Arbitrum networks and affected 156 wallets that had the “infinite approvals” option turned on. Those who did not enable this option were not affected by the exploit.

Li.Fi 團隊確認，這次攻擊發生在以太坊和 Arbitrum 網路上，影響了 156 個開啟「無限批准」選項的錢包。那些沒有啟用此選項的人不會受到該漏洞的影響。

In statements to Cointelegraph, spokespeople for Li.Fi said they contained the exploit, addressed the critical vulnerability, and contacted the proper law enforcement authorities to trace the stolen funds. At the time of this writing, the issue has been fixed, and Li.Fi is operating normally.

Li.Fi 發言人在向 Cointelegraph 發表的聲明中表示，他們遏制了該漏洞，解決了關鍵漏洞，並聯繫了適當的執法機構追蹤被盜資金。截至撰寫本文時，該問題已解決，Li.Fi 運作正常。

Related: Lazarus is moving millions from $305M DMM Bitcoin hack — ZachXBT

相關：Lazarus 正在從價值 3.05 億美元的 DMM 比特幣黑客攻擊中轉移數百萬美元 — ZachXBT

This is not the first time that a vulnerability in the Li.Fi protocol has been exploited. In March 2022, a similar exploit affected users who had the “infinite approval” option turned on, allowing hackers to drain $600,000 from the protocol from 29 wallets before the vulnerability was addressed.

這並不是 Li.Fi 協定中的漏洞第一次被利用。 2022 年 3 月，類似的漏洞影響了打開「無限批准」選項的用戶，導致駭客在漏洞解決之前從 29 個錢包的協議中盜取了 60 萬美元。

The protocol was quick to reimburse investors for their losses, refunding 24 wallets directly from its treasury and offering the remaining five wallets a voluntary compensation plan akin to that received by early angel investors of Li.Fi.

該協議很快就補償了投資者的損失，直接從其金庫退還 24 個錢包，並向其餘 5 個錢包提供類似於 Li.Fi 早期天使投資者所收到的自願補償計劃。

Crypto hacks put the damper on the industry in 2024

加密貨幣駭客攻擊將在 2024 年對該行業造成阻礙

Hacks and exploits continue to plague the crypto industry and the decentralized financial sector, in particular.

駭客和漏洞繼續困擾加密產業，尤其是去中心化金融領域。

A recent report from security firm Cyvers showed that 2024 losses from crypto exploits are nearing $1.4 billion, driven primarily by phishing attacks, and have risen sharply since 2023.

安全公司 Cyvers 最近的一份報告顯示，2024 年加密貨幣漏洞造成的損失接近 14 億美元，主要由網路釣魚攻擊造成，並且自 2023 年以來急劇上升。

Magazine: Best and worst countries for crypto taxes — plus crypto tax tips

雜誌：加密稅最好和最糟糕的國家 - 以及加密稅提示