Aggregators and routing

Junior · enrolled learners

This lesson opens with LI.FI and Jumper, 16 July 2024.

What happened

LI.FI is a routing and bridging aggregator, used directly and through the Jumper interface. Shortly after a new contract facet was added, a vulnerability in it allowed an attacker to perform a call injection, because the facet did not properly validate the call target and the call data it was given. That let the attacker execute arbitrary functions using the permissions the LI.FI contract already held. The permissions that mattered were unlimited token approvals granted by users to that contract. About $11.6M was taken from 153 wallets across Ethereum and Arbitrum, in USDC, USDT and DAI. The team disabled the vulnerable facet across all chains once detected. The exposure was limited to unlimited approvals and did not affect finite ones, which were already the default in the project's own API, software development kit and widget.

The decision point

The users who lost were the ones who had granted an unlimited approval, and that was not what the aggregator's own tooling did by default. So the loss did not follow from using the service. It followed from a setting, chosen once, that converted a per-trade permission into a standing power over the entire balance of that token, held by a contract whose code could change and did.

Recorded loss

$11,600,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.