What happened
On July 16, 2024, LI.FI's Diamond contract was exploited through a newly deployed GasZipFacet. The facet let an attacker invoke arbitrary calls through the LI.FI contract, draining tokens from users who had granted the Diamond unlimited ERC-20 approvals. LI.FI estimated about $11.6 million stolen from 153 wallets on Ethereum and Arbitrum.
The newly deployed GasZipFacet omitted the allowlist validation that other LI.FI facets apply to external-call targets and functions. Passing untrusted `_swapData` to a general low-level call therefore enabled arbitrary token-contract calls from the Diamond's pre-approved spender authority. LI.FI attributes the missing validation to a human deployment-review error.
Case & protocol details
Attack Timeline
Five days after the GasZipFacet was deployed, the attacker called depositToGasZipERC20() with crafted _swapData. That data flowed into LibSwap.swap(), whose low-level call used attacker-controlled call target and calldata. The attacker encoded ERC-20 transferFrom(victim, attacker, amount) calls. Because the LI.FI Diamond was already the approved spender for affected users, the arbitrary calls transferred their tokens without new user signatures.
The attacker repeated this across nearly one hundred transactions, then swapped much of the stablecoin haul to ETH and laundered funds through Tornado Cash. LI.FI disabled the vulnerable facet across chains. Its subsequent full-user-compensation commitment is not treated here as recovery of the stolen assets.
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.