Rico Credit System Hack

Rico Credit System was a stablecoin project on Arbitrum that described itself as a stability system without price oracles or governance. People who wanted to use the system approved its main contract to spend their tokens. That contract had a flaw in one of its functions, which would carry out almost any instruction it was given. On 20 April 2024, an attacker found this flaw and used it to make the contract transfer tokens out of wallets that had approved it.

Around $45k was taken in total, including both the funds held by the protocol itself and tokens drained from users' wallets. Later that day, Rico announced that RCS0, the version of the system it had deployed, had been drained, and that it was turning off its website because no funds were left. The team said it was working on shutting down the remaining parts of the system and would share an update on next steps.

Turning off the website does not disable the contract itself, so approvals given to it can still be abused. If you ever used Rico, check your approvals on Arbitrum and revoke any that point to the Rico contract. Revoking protects the tokens still in your wallet, but it does not recover tokens that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.