LiFi/Jumper - Rekt

LiFi protocol lost about $9.73M in an attack that drained addresses which had granted infinite token approvals to its contracts across multiple chains. LiFi acknowledged the hack roughly an hour after security firm CertiK raised the alarm, and Jumper Exchange, which uses LiFi's services, told users it appeared unaffected. According to Nick L. Franklin, the attack exploited a lack of validation in the "swap" function of a contract facet added on July 11th, enabling a "call injection" attack. The stolen USDT, USDC and DAI were swapped for 2,857 ETH, and LiFi suffered a similar exploit in March 2022 that lost $600K.