Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 1.
- Audits since
- 1, the latest dated 10 Jan 2025.
LI.FI security record
As of 14 Oct 2026, LI.FI has 2 audit reports by 2 security firms on Trustblock; the latest is by Cantina, dated 10 Jan 2025. Those reports list no open critical findings. It also holds 1 incident (latest 15 Jul 2024).
Critical findings
No open critical findings
Across 2 reports.
Incident
Incident 15 Jul 2024
Source: De.Fi incident database. 1 audit has been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Statuses are the security firms’ own. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| lifi-contracts[c9e624] | Security firm: Cantina | Date: | Scope: Not recorded. See the report | No open critical findings | Open · cantina.xyz |
| LI.FI | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 5 | 10 |
MediumGriefing attack possible by frontrunning the callDiamondWithEIP2612Signature function calllifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportMedium`jlength` Not Updated After a DEX is Removed From the StorageLI.FI · Quantstamp · 5 May 2022Fixed
On `L95` in `src/Facets/DexManagerFacet.sol`, the `jlength` is never updated after a DEX is removed from the storage using `_removeDex(j)`.
Open the reportLowAvoid duplicated code whenever possible to reduce inconsistencieslifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowInconsistent variable naminglifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowReduce unnecessary approval each timelifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowRemove unused inherited contractslifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowSuggestions to improve Readabilitylifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowUse functions provided in standard libraries for safeApprovelifi-contracts[c9e624] · Cantina · 10 Jan 2025Fixed
The report gives no description here.
Open the reportLowClone-And-OwnLI.FI · Quantstamp · 5 May 2022Fixed
LiFinance project uses the EIP-2535 standard implementation. In the related documentation (`docs/LibDiamond.md`) is stated that is copied from the proposed implementation of the EIP author: `mudgen/diamond-1-hardhat` GitHub repository. However, we found that the files have minor differences between them.
Open the reportLowEvents Should Be Emitted In Critical OperationsLI.FI · Quantstamp · 5 May 2022Fixed
Several contracts implement an "initializer" function. These functions can be called many times, modifying the storage of the contract. This includes critical variables, such as addresses pointing to tokens and bridges. The execution of these functions should emit events to track misuse. `CBridgeFacet` emits `Inited` event (declared in `ILiFi` interface) when initialized. However, `HopFacet`, `HyphenFacet` and `NXTPFacet` contracts do not emit events when initialized or when critical changes are made.
Open the reportShow 2 more
LowTwo Versions Of `Swapper.sol`LI.FI · Quantstamp · 5 May 2022Fixed
We noticed that there are two files named `Swapper.sol` with similar functionality. Observing the git history, we think that `src/Facets/Swapper.sol` was not removed when refactored into `src/Helpers/Swapper.sol`. Also, no contract imports or inherits from `src/Facets/Swapper.sol` (i.e., this file is never used). This can lead to confusion and unexpected behavior if a contract imports the wrong file.
Open the reportLowUnlocked PragmaLI.FI · Quantstamp · 5 May 2022Fixed
Every Solidity file specifies in the header a version number of the format pragma solidity (^)0.8.*. The caret (^) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version and above, hence the term "unlocked".
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lifi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us