On July 16, 2024 LI.FI protocol was exploited via insufficient input validation in GasZipFacet.sol, where the depositToGasZipERC20 function allowed user-controlled _swapData parameters to reach low-level calls with malicious transferFrom() calldata, draining $8-11M from 153 wallets with infinite approvals across Ethereum and Arbitrum.