Revisiting Rikkei Finance Exploit

Rikkei Finance suffered a DeFi exploit on 15 April 2022 when an attacker used an unprotected public function (setOracleData()) to point the platform’s price oracle to a malicious contract, enabling price manipulation of rTokens and the theft of approximately $1.1M in assets; the attacker then laundered funds (including deposits to Tornado Cash) and the project later announced reimbursements and oracle hardening measures.