OAK — OnChain Attack Knowledge

Worked example · 2026-04

Rhea Finance Margin-Parser Exploit — Apr 2026 — $18.4M

Loss
approximately $18.4M in extracted value. The attacker exploited a logic error in Rhea Finance's margin-calculation parser: the parser counted fake swap-route minimum amounts as real collateral, allowing the attacker to open leveraged positions backed by fabricated collateral values. The attacker extracted approximately $18.4M before the exploit was detected, of which approximately $9M was frozen or recovered through protocol and exchange intervention. Approximately $4M in ZEC entered Zcash's shielded pool and was rendered unrecoverable.
OAK Techniques observed
OAK-T9.004 (Access-Control Misconfiguration) — primary; the margin parser permitted borrowing that should have been gated by a collateral-solvency predicate, but the predicate was evaluated against the wrong subject — a user-supplied swap-route claim rather than a verified on-chain deposit. T9.004 is OAK's home for the missing-or-wrongly-subjected authorisation predicate and is its stated residual category for logic flaws. Not T9.001: that attacks the price input to a risk model; this attacked the collateral-quantity input. OAK-T7.005 (Privacy-Chain Hops) — the laundering tail; ~$4M in ZEC routed into Zcash's shielded pool as a pre-planned unfreezable exit. T17 dropped: no market was manipulated — the attacker deceived the protocol's internal accounting, not a price or other participants — and the file itself calls that leg "structurally adjacent" and an "outcome". The ~$9M frozen through exchange coordination is outcome.
Attribution
pseudonymous attacker; on-chain address identified but not linked to a named individual. The ZEC shielded-pool routing suggests a sophisticated attacker with pre-planned laundering infrastructure.
Key teaching point
The Rhea Finance exploit is the canonical "margin-accounting parser" vulnerability: the protocol's risk engine trusted a value — the minimum output amount of a swap route — that was attacker-controlled and not independently verified against actual collateral deposits. The parser's job was to calculate the collateral value of a user's position to determine maximum allowable leverage; by feeding the parser synthetic swap-route values that looked like real collateral but were not backed by actual deposits, the attacker inflated their collateral valuation and extracted borrowed assets against non-existent collateral. The structural lesson is that any DeFi protocol component that calculates collateral value from user-supplied parameters must independently verify that the parameters correspond to actual on-chain deposits — a parser that trusts user-supplied values is a parser that can be exploited. This is the margin-accounting analogue of the oracle-manipulation class (T9.001): instead of manipulating the price feed, the attacker manipulates the collateral-valuation feed.

Summary

Rhea Finance is a DeFi protocol offering leveraged trading and lending across multiple asset pairs. The protocol's margin engine calculated a user's collateral value to determine their maximum allowable borrow amount. The margin parser — a component of the risk engine responsible for parsing and validating the collateral inputs — was designed to accept swap-route parameters (token paths, pool addresses, minimum-output amounts) and calculate the effective collateral value of a user's deposited assets routed through those swap paths.

The vulnerability was in the parser's handling of the swap-route minimum-output values. The parser treated the amountOutMinimum field of a swap route as a verified collateral value — it assumed that if a swap route specified a minimum output of X, then X worth of collateral was available. The parser did not verify that:

  • The swap route was executable (the pools existed and had sufficient liquidity).
  • The minimum output corresponded to an actual on-chain deposit.
  • The user had the authority to execute the swap route and capture the output.

An attacker who specified a swap route with a fabricated amountOutMinimum value could cause the parser to credit that value as collateral — without executing the swap, depositing the output, or even having the tokens available to execute the swap. The attacker effectively "declared" a collateral value, and the parser believed it.

On April 16, 2026, the attacker exploited this vulnerability:

  1. Fabricate swap routes. The attacker constructed swap-route parameters with inflated amountOutMinimum values, pointing to real DEX pools but with minimum-output amounts far exceeding what those pools would actually deliver.

  2. Feed to margin parser. The attacker submitted these fabricated swap routes to Rhea's margin engine. The parser accepted the amountOutMinimum values as verified collateral and credited the attacker's position with the inflated collateral valuation.

  3. Borrow against fabricated collateral. With the inflated collateral valuation, the attacker opened leveraged borrow positions — borrowing real assets (ETH, USDC, stablecoins) against collateral that existed only in the parser's calculation.

  4. Extract and launder. The attacker withdrew the borrowed assets. Approximately $18.4M was extracted. Of this, ~$9M was frozen or recovered through protocol intervention (pausing contracts, coordinating with exchanges to freeze deposited funds), and ~$4M in ZEC was routed into Zcash's shielded pool, making it unrecoverable.

The exploit was detected when the protocol's risk-monitoring systems flagged the anomalous borrow volume. However, the extraction had already occurred in the same transaction bundle as the fabricated-collateral submission, giving the protocol no window for intervention before the funds were withdrawn.

Timeline (UTC)

When Event OAK ref
pre-2026-04 Rhea Finance margin parser deployed; parser trusts user-supplied swap-route minimum-output values without independent verification T9 (standing vulnerability)
2026-04-16 Attacker constructs fabricated swap-route parameters; submits to margin parser; parser credits inflated collateral valuation T9 (margin-parser exploit)
2026-04-16 Attacker opens leveraged borrow positions against fabricated collateral; withdraws borrowed assets; extracts ~$18.4M T9 + T17
2026-04-16 Rhea Finance detects exploit; pauses protocol; coordinates with exchanges to freeze deposited funds; ~$9M frozen/recovered (incident response)
2026-04-16 Attacker routes ~$4M in ZEC into Zcash shielded pool; funds become unrecoverable (laundering)
2026-04 onward Protocol post-mortem; margin-parser redesign with independent collateral verification; recovery plan for affected users (remediation)

Public references

  • Rhea Finance official incident announcement and post-mortem (April 2026)
  • On-chain forensic analysis of fabricated swap-route transactions and inflated-collateral borrow positions
  • Exchange freeze coordination and recovery-tracking data
  • Zcash shielded-pool routing analysis
  • See techniques/T9 smart-contract exploit techniques and techniques/T17 market manipulation techniques for Technique definitions

Discussion

The Rhea Finance exploit introduces a novel DeFi vulnerability class to the OAK taxonomy: the margin-parser trust-surface. The vulnerability sits at the intersection of smart-contract logic (T9) and market-structure manipulation (T17): the attacker exploited a logic error in the protocol's own risk engine to manipulate the protocol's collateral-valuation model, and the extraction was through the protocol's own lending/borrowing mechanism — an "inside-out" exploit where the protocol's risk-assessment infrastructure is the target.

The margin-parser vulnerability is structurally distinct from oracle manipulation (T9.001): oracle manipulation attacks the price input to the risk model (inflating the price of a collateral asset to borrow more against it), while margin-parser exploitation attacks the collateral-valuation input (inflating the quantity or value of collateral without affecting its market price). The oracle-manipulation attacker tricks the protocol into thinking 1 ETH = $10,000; the margin-parser attacker tricks the protocol into thinking they deposited 100 ETH when they deposited 0 ETH. The defender lesson: risk-engine inputs must be independently verified at every layer — price (oracle), quantity (on-chain balance check), and composability (can the claimed swap route actually execute?) — and no single parser component should trust a user-supplied value without an on-chain verification step.

The Zcash shielded-pool routing is tactically notable: the attacker pre-planned a laundering path that could not be frozen or reversed, demonstrating that sophisticated DeFi exploiters now incorporate privacy-chain exit routes into their pre-exploit planning — the Zcash shielded pool is as much a part of the exploit's architecture as the fabricated swap routes. The ~$4M that entered the shielded pool is structurally lost — Zcash's shielded transactions are cryptographically private, and there is no centralised entity that can freeze or reverse them, unlike the ~$9M that was recovered through exchange-freeze coordination.

The incident anchors the T9 × 2026 and T17 × 2026 matrix cells and introduces the margin-parser vulnerability as a candidate sub-class at the T9/T17 boundary. Future v0.x expansions should track whether the margin-parser pattern recurs in other DeFi protocols — any protocol that calculates collateral value from user-supplied swap-route or multi-hop parameters without independent on-chain verification is a candidate for the same exploit class.

Techniques demonstrated (2)