Liquid Crypto Hack

Funds were stolen from users of Liquid Crypto (LQDX), a multichain liquidity protocol, on the 10th of January 2024. Its LiquidXv2Zap contracts exposed a deposit function that accepted an arbitrary account argument without checking that it matched the caller, so an attacker could call deposit on behalf of any wallet that had approved the zap and spend that approval to pull the wallet's tokens into a Liquid Crypto pool. SlowMist flagged the vulnerable zaps across several chains and Liquid Crypto redeployed new contracts, but the old zaps were left in place, so any approval to them should be revoked.

Los usuarios afectados seguirán en riesgo mientras no hayan revocado sus autorizaciones, por lo que se recomienda utilizar el Comprobador de Exploits de Revoke.cash que aparece a continuación para asegurarte de que estás a salvo.