Lesson learned from Li.Fi ♾️
The cross-chain DeFi protocol Li.Fi has just suffered an $11M exploit, with funds stolen from the platform's users.
The wallet that is believed to be the mastermind behind the attack managed to steal close to $6M in ETH, along with various other stablecoins such as USDC, USDC, and DAI.
While the exploit was still happening yesterday, the team urged users to revoke their approvals for several of Li.Fi's bridge contracts.
However, the intrusion has since been contained, with the team confirming that only users who had set infinite approvals were affected.
While the protocol has yet to issue a detailed report regarding the cause of the exploit, blockchain security firm Decurity stated that the hacker had taken advantage of a vulnerability in a recent deployment of the 'GasZipFacet' smart contract.
In a nutshell, the hacker was able to submit specially created data into the contract, which is mistaken as data for swapping tokens, allowing the hacker to steal approved tokens from the Li.Fi bridge.
Editor's Note: Another cautionary tale regarding the perils of infinite approvals. While it may seem easier to just set and forget for specific assets, all of those assets in your wallet are now completely up for grabs should the approved spender be exploited. On the other hand, setting up fixed amounts for approvals every time you use a different protocol can be a hassle, but it goes a long way in securing your unutilized funds. | 
0 Komentar untuk "🦎🚀 Perhaps it's time to check those token approvals again? 📝"