What happened
LI.FI's Diamond contract was exploited on July 16, 2024 shortly after a new GasZip facet was deployed. The facet omitted the usual target and function validation for external calls, allowing an attacker to drain wallets that had granted infinite token approvals to the LI.FI contract. LI.FI reported about $11.6 million stolen from 153 wallets on Ethereum and Arbitrum.
The new GasZip facet did not enforce the whitelist validation that restricted external call targets and function selectors in LI.FI's other facets. A router holding standing token approvals must never execute unrestricted caller-supplied target and calldata. Every newly deployed facet must independently enforce the validation assumptions of its shared low-level-call libraries.
Case & protocol details
Attack Timeline
The attacker selected wallets with unlimited approvals to the LI.FI Diamond and called depositToGasZipERC20() with attacker-controlled swap data. The newly deployed GasZipFacet forwarded that data to LibSwap.swap(), whose low-level call could reach an attacker-selected target with attacker-selected calldata. The payload encoded ERC-20 transferFrom(victim, attacker, amount).
Because the Diamond was already an approved spender, the transfers succeeded without a new transaction from each victim. LI.FI disabled the facet across chains after detection.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- report Report x.com
- report LI.FI security incident report, July 16 li.fi
- transaction Transaction etherscan.io
- code Code reference github.com
- analysis BlockSec and MetaSleuth LI.FI incident analysis blocksec.com
- analysis Olympix LI.FI exploit analysis olympix.security
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.