Malicious code in lifi-contracts (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2611 Malicious code in lifi-contracts (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2023-8620 Malicious code in pillar-lifi-zap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f6752cdfc26aa682f3cbce0cfb7c709c97f885cbfae33367ffa76e599a041393 The OpenSSF Package Analysis project identified 'pillar-lifi-zap' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in pillar-lifi-zap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f6752cdfc26aa682f3cbce0cfb7c709c97f885cbfae33367ffa76e599a041393 The OpenSSF Package Analysis project identified 'pillar-lifi-zap' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

User will lose value on swap-and-bridge / multi-swap

Lines of code Vulnerability details Impact In a swap-and-bridge or multi-swap, user have to supply exact amount of input token for each step. Any positive slippage will be captured by the contract and any negative slippage will cause the swap to revert. This is a sub-optimial behavior as it will...

All swapping functions lack checks for returned tokens

Lines of code Vulnerability details Impact Every function that stems from the GenericSwapFacet lacks checks to ensure that some tokens have been returned via the swaps. In LibSwap.sol in the swap function, the swap call is sent to the target DEX. A return of success is required, otherwise the...

Lack of checks between _swapData and _lifiData could lead to loss of funds and reputation risk.

Lines of code LibSwap.swap swapTokensGeneric Vulnerability details Impact Users could input incongruent values for lifiData and swapData leading to a swap no being processed correctly and users not getting any of the expected lifiData.receivingAssetId. It can also damage reputation because LiFi...