Smart Contract Assessment
Audit · firm’s term: smart contract assessment
Halborn reviewed LI.FI (Smart Contract Assessment) on 28 Jul 2026: 5 findings, 0 critical; 1 marked fixed, 4 acknowledged.
Report hosted on halborn.com.
Trustblock does not review code.
Findings38
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 4 | 1 |
Marked Informational by the firm. Not counted as findings.
InformationalA newly registered interface receives no TTL extension at write, and the extension applied on read is shorter than the lifetime the network grants a new entryAcknowledged
The report gives no description here.
InformationalA proposal tagged Add silently overwrites a live interface, so the review signal and the effect disagreeAcknowledged
The report gives no description here.
InformationalA token contract registered as an adapter lets any anonymous caller drain the router's balanceAcknowledged
The report gives no description here.
InformationalAdd and Remove operator proposals silently discard the threshold and timelock they were approved with, and the creation-time check validates those fields against the wrong operator setAcknowledged
The report gives no description here.
InformationalAdmin authority transfers in one step to an address that never signed, with no pending state to cancel, while adding a single operator requires quorum and a timelockAcknowledged
The report gives no description here.
InformationalAn unbounded timelock in a routine Update permanently disables proposal creation and surrenders governance to the admin keyAcknowledged
The report gives no description here.
Informationalapprove_proposal accepts approvals for an already-executed proposal, rewriting the only record of who authorised the actionAcknowledged
The report gives no description here.
Informationalget_interface is shaped like a getter but performs a permissionless persistent-storage write on every callAcknowledged
The report gives no description here.
InformationalInterface revocation is per-name rather than per-contract, so a shadow alias survives removal of a compromised adapterAcknowledged
The report gives no description here.
InformationalNothing on-chain requires a fee: any anonymous user can omit the fee list and use the router for freeAcknowledged
The report gives no description here.
Show 10 more
InformationalOperators have no unpause or upgrade path, so loss of the single admin key leaves a paused protocol permanently haltedAcknowledged
The report gives no description here.
InformationalProposal entries are never TTL-extended after creation, and the project's persistent extension constants sit far below the network minimumAcknowledged
The report gives no description here.
InformationalProposal quorum is evaluated against an operator-set snapshot, so removing a compromised operator does not invalidate their banked approvalsAcknowledged
The report gives no description here.
InformationalProposals never expire: proposal_ends_at is a floor with no ceiling, so an approved proposal stays executable indefinitelyAcknowledged
The report gives no description here.
InformationalRegistering an adapter grants it the router's own authority for the duration of the callAcknowledged
The report gives no description here.
InformationalRevoking an interface that was never registered reports success, so a failed revocation looks identical to a successful oneAcknowledged
The report gives no description here.
InformationalThe constructor installs an unvalidated OperatorConfig, so a zero threshold produces governance that executes proposals with no approvalsAcknowledged
The report gives no description here.
InformationalThe constructor's pause sub-call requires the admin's authorization, so a deployment naming a separate admin account cannot succeed on the deployer's signature aloneAcknowledged
The report gives no description here.
InformationalThe one-unit fee floor lets a split fee list charge many times the declared rate on small amountsAcknowledged
The report gives no description here.
InformationalThe Rust toolchain is pinned only to "stable", so the deployed WASM is not reproducible and no minimum supported version is declaredAcknowledged
The report gives no description here.
Show 10 more
InformationalThe standalone swap and bridge entry points have no deadline, while the chained entry point enforces oneAcknowledged
The report gives no description here.
InformationalThe trade amount is bounded below but not above, so a large amount aborts in the fee multiplication with an untyped host errorAcknowledged
The report gives no description here.
InformationalThe upgrade path writes new code and nothing else: no migration hook, no on-chain schema version, and no instance TTL refreshAcknowledged
The report gives no description here.
Informationalvalidate_contract performs no check at all when wasm_hash is null, so an interface can be registered pointing at an address that is not a contractAcknowledged
The report gives no description here.
InformationalDuplicate addresses in an operator-set update defeat the anti-lockout check and permanently brick governanceFixed
The report gives no description here.
InformationalError-code hygiene: ten of eighteen declared errors are asserted by no test, one is never raised at all, and the numbering has an unexplained gapFixed
The report gives no description here.
InformationalMutation testing shows the shipped test suite does not cover eleven of twenty-one guards, including the router's central spend cap and the entire pause gateFixed
The report gives no description here.
InformationalNo administrative path extends the instance TTL, so a paused contract with no proposal traffic is not self-sustainingFixed
The report gives no description here.
InformationalNo governance action emits any event, so adapter registration and retargeting are invisible to off-chain monitoringFixed
The report gives no description here.
InformationalThe check that rejects a negative slippage floor exists but is wired only to the chained entry point, so the standalone swap accepts a floor below zeroFixed
The report gives no description here.
Show 3 more
InformationalThe router accepts itself as a fee destination and has no recovery path, so any balance it accumulates is strandedFixed
The report gives no description here.
InformationalThree event schema defects: a topic slot spent on a constant, a receiver field that always holds the sender, and a self-referential admin change at deploymentFixed
The report gives no description here.
InformationalUnknownInterface is unreachable because get_interface extends the TTL before reading, so a revoked adapter reports an untyped host errorFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of LI.FI’s security record
LI.FISecurity firm
Halborn36 projects reviewed · 80 reports · latest Oct 2026
See Halborn’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us