LI.FI - Security Incident Report 16th July

LI.FI's smart contract was exploited on July 16, 2024, shortly after a new facet was added, with an estimated $11.6 million stolen from 153 wallets on Ethereum and Arbitrum. The vulnerability let the attacker reach self-custodial wallets that had given the LI.FI contract infinite token approval, and the article says finite approvals, the default in the LI.FI API, SDK, and widget, were not affected. According to the article, the flaw came from a missing whitelist check on arbitrary calls in the LibSwap library, caused by an individual human error during deployment. LI.FI says it disabled the facet across all chains and is evaluating ways to compensate affected users.