LiFi Finance Hack
What happened
On July 16, 2024, LI.FI's Diamond contract was exploited through a newly deployed GasZipFacet. The facet let an attacker invoke arbitrary calls through the LI.FI contract, draining tokens from users who had granted the Diamond unlimited ERC-20 approvals. LI.FI estimated about $11.6 million stolen from 153 wallets on Ethereum and Arbitrum.
The newly deployed GasZipFacet omitted the allowlist validation that other LI.FI facets apply to external-call targets and functions. Passing untrusted _swapData to a general low-level call therefore enabled arbitrary token-contract calls from the Diamond's pre-approved spender authority. LI.FI attributes the missing validation to a human deployment-review error.
How it happened
Five days after the GasZipFacet was deployed, the attacker called depositToGasZipERC20() with crafted _swapData. That data flowed into LibSwap.swap(), whose low-level call used attacker-controlled call target and calldata. The attacker encoded ERC-20 transferFrom(victim, attacker, amount) calls. Because the LI.FI Diamond was already the approved spender for affected users, the arbitrary calls transferred their tokens without new user signatures.
The attacker repeated this across nearly one hundred transactions, then swapped much of the stablecoin haul to ETH and laundered funds through Tornado Cash. LI.FI disabled the vulnerable facet across chains. Its subsequent full-user-compensation commitment is not treated here as recovery of the stolen assets.
Protocol details
Evidence
- report @RektHQ incident report x.com
- report @lifiprotocol incident report twitter.com
- report @SlowMist_Team incident report x.com
- report LI.FI security incident report, July 16 li.fi
- transaction Etherscan representative exploit transaction etherscan.io
- code LI.FI GasZipFacet pull request github.com
- analysis DeFiLlama defillama.com
- analysis LI.FI Attack Fund-Flow Case Study metasleuth.io
- analysis LI.FI Loses Estimated $9 Million in Exploit theblock.co
- analysis BlockSec and MetaSleuth LI.FI incident analysis blocksec.com
- analysis Olympix LI.FI exploit analysis olympix.security
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
