Liquid Crypto Hack

Funds were stolen from users of Liquid Crypto (LQDX), a multichain liquidity protocol, on the 10th of January 2024. Its LiquidXv2Zap contracts exposed a deposit function that accepted an arbitrary account argument without checking that it matched the caller, so an attacker could call deposit on behalf of any wallet that had approved the zap and spend that approval to pull the wallet's tokens into a Liquid Crypto pool. SlowMist flagged the vulnerable zaps across several chains and Liquid Crypto redeployed new contracts, but the old zaps were left in place, so any approval to them should be revoked.

Затронутые пользователи остаются под угрозой до тех пор, пока не отзовут свои доступы, поэтому рекомендуется воспользоваться приведенной ниже проверкой эксплойтов Revoke.cash, чтобы убедиться, что вы в безопасности.