In The Most Recent DeFi Hack, The Li Finance Protocol Loses $600,000

Users of the Li Finance (LiFi) protocol lost roughly $600,000, however some of them have been compensated when a hacker exploited a flaw in the project’s smart contract.

A smart contract vulnerability at the Li Finance swap aggregator resulted in the theft of about $600,000 from 29 users’ wallets.

On March 20, at 2:51 a.m. UTC, an exploit was discovered. From wallets that had provided “unlimited approval” to the Li Finance protocol, the attacker was able to extract variable quantities of 10 different tokens. USD Coin (USDC), Polygon (MATIC), Rocket Pool (RPL), Gnosis (GNO), Tether (USDT), Metaverse Index (MVI), Audius (AUDIO), AAVE (AAVE), Jarvis Reward Token (JRT), and DAI were among the tokens that were stolen (DAI).

The team discovered the exploit 12 hours later, at 2:15 p.m. UTC, and immediately disabled all switching features on the platform to prevent any future losses.

On March 21, at 2:50 a.m. UTC, the team released a post mortem documenting the exploit’s occurrences. According to the team, the attacker exchanged the stolen tokens for a total of 205 Ether (ETH) worth around $600,000. The stolen ETH had yet to be moved from the attacker’s wallet at the time of writing.

The flaw has also been detected and addressed, according to Li Finance

25 of the 29 wallets that were targeted in this attack have had their losses repaid from treasury funds. Only $80,000, or 13% of the entire value, was stolen from those 25 wallets. The owners of the remaining four wallets, which collectively lost $517,000, have been approached and given a contract to reimburse them for their losses as angel investors in the protocol.

They would receive LiFi tokens in an amount equal to their losses from each wallet, on the same terms as regular angel investors. This would also assist to prevent the platform’s treasury from being harmed.

The hacker was also contacted and a bug bounty was promised in exchange for the money

The attack looks to have occurred at a bad time. “We’re literally a week away from our audit,” Li Finance CEO Philipp Zentner told Cointelegraph on March 21. “We have various companies auditing us.”

According to “Transmissions11,” a researcher with crypto investment firm Paradigm, even a comprehensive examination of the code may not have picked up this particular problem. In a March 21 tweet, he highlighted that the problem in Li Finance’s code is “subtle if you’re not in the appropriate mentality.”

This newest attack in the decentralized finance (DeFi) sector highlights how providing smart contracts endless approvals exposes a user’s funds to more risk. Users with infinite approvals can transfer currencies as many times as they like on a decentralized exchange (DEX) without having to approve any more transactions.

Join CoinCu Telegram to keep track of news: https://t.me/coincunews

Follow CoinCu Youtube Channel | Follow CoinCu Facebook page

Annie

CoinCu News