Leaderboard
622All-time rank
Rikkei Finance
Apr 15, 2022
$1.1M
Lost
$1.1M
Recovered
$0
Net loss
$1.1M
Unrecovered0% recovered
Rikkei Finance lending protocol lacked permission controls in the setOracleDate function, allowing an attacker to manipulate oracle prices. 0001 BNB as collateral, the attacker borrowed all USDC, BTC, DAI, USDT, and BUSD from liquidity pools by inflating collateral value through the malicious oracle.
How the exploit worked
View reproducible PoCAccess control & Price Oracle Manipulation.
Lost: $1.1 million (2671 BNB)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
BSC
Event timeline
- Apr 15, 2022Exploit executed — $1.1M drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)