What happened
On April 15, 2022, an attacker drained about $1.1 million from Rikkei Finance's BSC lending pools after replacing the legitimate collateral oracle with a malicious contract. The public setOracleData function lacked authorization, so the attacker inflated rBNB collateral's value and borrowed assets from multiple pools.
How it happened
- The attacker obtained a small amount of rBNB collateral.
- It called the public
setOracleData()function to replace the legitimate rBNB oracle with a malicious price source. - The inflated rBNB valuation allowed borrowing of USDC, BTCB, DAI, USDT and BUSD from the lending pools.
- The attacker exchanged the borrowed assets for BNB and sent the proceeds to Tornado Cash.
Protocol details
Classification
NFT / Borrowing and Lending / Access Control
Protocol Type
Lending
Affected asset / contract
RIFI
Implementation language
Solidity
Protocol links
Website
@rikkeifinance
Security review history
- Hacken View report
Evidence
- report Report certik.com
- report Report knownseclab.com
- report Report blockmagnates.com
- report Report rikkeifinance.medium.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis Revisiting Rikkei Finance Exploit certik.com
- analysis SlowMist: Forensic Analysis of Rikkei Finance Hack slowmist.medium.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
