Rikkei

title	description	type	network	date	loss_usd	returned_usd	tags	subcategory	vulnerable_contracts	tokens_lost	attacker_addresses	malicious_token	attack_block	reproduction_command	attack_txs	sources
Rikkei Oracle Replace	Setting malicious price oracles through unprotected functions	Exploit	binance smart chain	2021-04-15	1000000	0	access control		0xd55f01b4b51b7f48912cd8ca3cdd8070a1a9dba5	BUSD USDT USDC	0xA36F6F78B2170a29359C74cEFcB8751E452116f9 0xe6DF12a9f33605F2271D2a2DdC92E509E54E6b5F		16956475	forge test --match-contract Exploit_Rikkei -vvv	0x93a9b022df260f1953420cd3e18789e7d1e095459e36fe2eb534918ed1687492	title url Known Sec Labs Report https://knownseclab.com/news/625e865cf1c544005a4bdaf2

Step-by-step

1. Call setOracleData to set your own oracle for a token
2. Take favorable loans using the malicious price

Detailed Description

The Rikkei Oracle contract did not prevent someone from calling their setOracleData function.

    function setOracleData(address rToken, oracleChainlink _oracle) external {
        oracleData[rToken] = _oracle;
    }

Once a malicious oracle is set (the attacer's is here), the attacker can get loans for a monstruous amount of money with little to no collateral.

The attacker:

1. Put 0.0001 BNB to get 4995533044307110.024 rBNB.
2. Took a loan of 346199.781 USDC with the rBNB.
3. Exchanged the USDC for 776.298 WBNB
4. Repeated this process with all stablecoins available
5. Restored Oracle
6. Exit the WBNB through Tornado Cash

Possible mitigations

• The setOracleData had to be either internal or authenticated.

Related

• Sandbox Public Burn - Unprotected public function allows anyone to cause damage
• DAO maker - Missing access control on critical function
• Polter Finance - Oracle manipulation to drain lending protocol