Liquid Crypto Hack

Funds were stolen from users of Liquid Crypto (LQDX), a multichain liquidity protocol, on the 10th of January 2024. Its LiquidXv2Zap contracts exposed a deposit function that accepted an arbitrary account argument without checking that it matched the caller, so an attacker could call deposit on behalf of any wallet that had approved the zap and spend that approval to pull the wallet's tokens into a Liquid Crypto pool. SlowMist flagged the vulnerable zaps across several chains and Liquid Crypto redeployed new contracts, but the old zaps were left in place, so any approval to them should be revoked.

受影响的用户只要没有撤销他们的授权，就仍处于风险之中。因此我们建议您使用下方的 Revoke.cash 漏洞检查器，以确保您的安全。