Li.Fi

A $10M loss on Ethereum in 2024, caused by an unchecked external call flaw. Here's what happened, the vulnerability class behind it, and where it stands in ProveWall's re-proof pipeline.

$10Mreported loss

2024year

Ethereumchain

Unchecked external callvulnerability class

Mechanism — unchecked arbitrary call in facet -> approval drain

✔ Re-proven on a forked chain

We re-executed this exploit against the incident state on a forked chain and it moved value — the vulnerability reproduces. We have not separately re-tested the project's post-mortem patch against it, so this page claims the reproduction only.

What this class of bug is

Unchecked external-call flaws let a contract be steered into calling attacker-controlled code or targets, turning an approval or transfer into a drain.

How to read this page. The dollar figure is the publicly reported loss attributed to this incident. A ProveWall re-proof reproduces the vulnerability class/mechanism by execution on a forked chain, with a signed receipt — we say so explicitly only once that execution has passed.

Want your own contract actually proven — not guessed?

Static tools and LLM auditors ask "is there a check here?" and miss the check that exists but is wrong. OmniGuard Labs runs the exploit on a forked chain and sends you a signed pass/fail receipt. Request a proof-backed audit →

Incident pages summarize public exploits for research; re-proofs execute on a forked chain and every claim is independently verifiable.