🪣Exploiting Infinite Approvals and Arbitrary Contract Calls

Vulnerability Overview: Infinite Approvals

Infinite approvals allow a smart contract to spend an unlimited amount of tokens on behalf of a user. In many cases, users grant infinite approvals to save on gas fees and avoid the inconvenience of approving each transaction individually. However, this convenience comes at the cost of security. If a contract is compromised, malicious actors can drain all the approved tokens without requiring any further user confirmation.

The primary issue arises when a smart contract does not properly handle arbitrary contract calls or input validation. This can allow attackers to make unauthorized function calls, potentially transferring user funds to their own accounts.

How Infinite Approval Exploits Occur

Here’s how the exploit typically works:

1. Infinite Approval Granted: A user grants infinite approval to a smart contract, allowing the contract to transfer tokens on their behalf.

2. Compromised or Insecure Contract: The contract is insecure, either due to poor coding practices or an exploit discovered by a malicious actor.

3. Arbitrary Function Call: The attacker exploits the contract by making an arbitrary function call, which transfers the user's tokens from their wallet to the attacker's address.

4. Tokens Drained: Because the contract has infinite approval, the attacker can continue making transfers without any further input or approval from the user, draining their tokens.

Real-World Example: Li.Fi Attack

In July 2024, Li.Fi—a cross-chain DeFi protocol—suffered a significant attack that exploited arbitrary call vulnerabilities. The root cause was that a function allowed unsanitized user input to pass through to a low-level call, enabling the attacker to craft malicious calldata. The attacker leveraged this exploit, combined with infinite approvals that users had granted to the contract, to make unauthorized transfers from users' wallets. As a result, Li.Fi lost approximately $8 million in the attack.

This example highlights the dangers of infinite approvals when combined with poorly validated arbitrary contract calls. Even a minor coding oversight can lead to significant financial losses.

Conclusion

Infinite approvals can be a double-edged sword in decentralized applications. While they provide convenience for users, they also introduce significant security risks if not handled properly. When combined with unvalidated arbitrary contract calls, infinite approvals can be exploited to steal tokens and execute unauthorized transactions.

To mitigate these risks, developers should implement validation mechanisms, avoid infinite approvals, and conduct regular security audits to ensure that their smart contracts are secure. Users, on the other hand, should revoke infinite approvals when not in use and be cautious of the contracts they interact with.

By following these best practices, the risk of exploitation can be significantly reduced, protecting both users and protocols from financial losses.