AIKIDO-2026-749277

@lifi/perps-sdk-provider-lighter is vulnerable to Incorrect Authorization

Incorrect Authorization Pre-CVE Published Yesterday

Medium Risk

This Affects:

@lifi/perps-sdk-provider-lighter

1.0.0 - 12.1.1

Fixed in 13.0.0

Are you affected? Scan for Free

TL;DR

The Lighter provider signs TRANSFER actions through the generic signStandardWasmAction path using only the stored Lighter API key. Because no end-user L1 wallet signature binds the destination account and the amount to the account owner, a TRANSFER step handed to the signer authorizes a payout to an arbitrary L1 destination with the API key alone. The signed transaction is broadcast to Lighter and settles the move without the account owner's consent. The patch adds a dedicated signTransfer flow that requires the user's wallet to countersign the transfer as L1Sig and makes sign() reject TRANSFER.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application uses the Lighter provider to sign transfer actions.