Beosin: Analysis of the attack on the cross-chain protocol LI.FI

According to Beosin Alert monitoring and warning, the cross-chain protocol LI.FI was attacked. The Beosin security team found that the cause of the vulnerability was that the attacker used the call injection of the project contract to transfer the assets of the user authorized to the contract. The LI.FI project contract has a depositToGasZipERC20 function, which can convert the specified token into platform currency and deposit it into the GasZip contract. However, the code in the exchange logic does not restrict the data of the call call, which allows the attacker to use this function to perform a call injection attack and extract the assets of the user authorized by the contract. Attacker address: 0x8B3Cb6Bf982798fba233Bca56749e22EEc42DcF3 Attacked contract: 0x1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE Beosin Trace is tracking the stolen funds.