LI.FI

Quantstamp5 May 2022Files named in the report

Audit

Quantstamp reviewed LI.FI on 5 May 2022: 10 findings, 0 critical; 5 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open LI.FI’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	0
Medium	0	0	1
Low	0	4	4

LowDiamond Facet Upgrade Could Lead to InconsistencyAcknowledged

If during an upgrade `diamondCut(...)` calls are executed in multiple Ethereum transactions, users may be exposed to contracts that are upgraded only partially (i.e., some of the functions are upgraded while others are not). This may result in unexpected inconsistencies.

LowHighly Dependent On Offchain ComponentsAcknowledged

For all the bridging facets the input parameters of its functions that are open to arbitrary end users are all generated by offchain components which can be hacked or DDoSed and the data passed in are never checked.

LowMissing Input CheckAcknowledged

`constructor` in `src/LiFiDiamond.sol` does not check if `address _contractOwner` and `address _diamondCutFacet` are non-zero addresses.

LowPrivileged Roles and OwnershipAcknowledged

There are some actions that could have important consequences for end-users. 1. The programs deployed are upgradable and can be changed by the admin team at any time at will. 1. Based on `L22` of `src/Facets/WithdrawFacet.sol`, the admin team of the platform can transfer whatever ether/ERC20 assets that are held by the platform to any address for rescue purposes. 1. Based on `src/Facets/DexManagerFacet.sol`, the platform owner can approve any dex and any function signature.