On July 16th, the Li.Fi exploit on the Ethereum mainnet resulted in an $11.6M loss. The root cause was a flaw in the depositToGasZipERC20() function within the GasZipFacet.sol contract, which allowed user-controlled data to be passed directly to a low-level call, enabling unauthorized function execution. The Li.Fi team acknowledged the exploit, halted all transactions, and issued warnings to their users.
0xf28a352377663ca134bd27b582b1a9a4dad7e534
0xd82fe84e63b1aa52e1ce540582ee0895ba4a71ec5e7a632a3faa1aff3e763873
The Olympix vulnerability detection system successfully identified a critical security flaw that directly led to the Li.Fi exploit. Specifically, it flagged an "Unverified Parameter" issue in the LibSwap.sol contract, which corresponds to the vulnerability in the depositToGasZipERC20() function that served as the entry point for the attack. This detection demonstrates Olympix's ability to identify subtle yet critical flaws in smart contract implementations that can lead to unauthorized function execution.
The highlighted code snippet shows a low-level call (_swap.callTo.call()) where the parameters are not adequately verified before execution. This exactly mirrors the exploit's root cause, where user-controlled data was passed directly to a low-level call. Olympix's successful detection of this vulnerability underscores the importance of thorough input validation and the risks associated with unverified external calls in smart contracts. This finding reinforces the value of automated security tools like Olympix in complementing manual audits and helping prevent high-impact security breaches in decentralized finance systems.