Leaderboard
206All-time rank
LF
LiFi Finance
Jul 16, 2024
$9.7M
Lost
$9.7M
Recovered
$0
Net loss
$9.7M
Unrecovered0% recovered
sol, where the depositToGasZipERC20 function allowed user-controlled _swapData parameters to reach low-level calls with malicious transferFrom() calldata, draining $8-11M from 153 wallets with infinite approvals across Ethereum and Arbitrum.
- Target
- Bridge
- Classification
- Access Control
- Technique
- Token Approval Abuse
- Attribution
- Unknown
- Chains
zkSync EraLineaMetis
Event timeline
- Jul 16, 2024Exploit executed — $9.7M drained via token approval abuse
- Attributed to Unknown
- Recovery status Unrecovered 0%