Liquid Crypto Hack

Funds were stolen from users of Liquid Crypto (LQDX), a multichain liquidity protocol, on the 10th of January 2024. Its LiquidXv2Zap contracts exposed a deposit function that accepted an arbitrary account argument without checking that it matched the caller, so an attacker could call deposit on behalf of any wallet that had approved the zap and spend that approval to pull the wallet's tokens into a Liquid Crypto pool. SlowMist flagged the vulnerable zaps across several chains and Liquid Crypto redeployed new contracts, but the old zaps were left in place, so any approval to them should be revoked.

影響を受けたユーザーは、承認を取り消さない限りリスクにさらされ続けるため、以下の Revoke.cash エクスプロイトチェッカーを使用して、ご自身が安全であることを確認することをお勧めします。