DeFi Project Cream Finance Suffers $34 Million Hack
According to Cream Finance, the hack was executed "by way of reentrancy on the AMP token contract."
Share this article
Cream Finance has reported a major hack that a $34 million loss, according to the team.
Reentrancy Bug Behind Cream Finance Exploit
Cream Finance has been exploited.
The DeFi lending protocol reported its CREAM V1 market had been targeted Monday.
C.R.E.A.M. v1 market on Ethereum has suffered an exploit, resulting in a loss of 418,311,571 in AMP and 1,308.09 in ETH, by way of reentrancy on the AMP token contract.
We have stopped the exploit by pausing supply and borrow on AMP. No other markets were affected.
— Cream Finance 🍦 (@CreamdotFinance) August 30, 2021
The hacker took advantage of a reentrancy bug on the token contract for AMP, a Consensys-backed digital collateral token listed within the dApp. The supply and borrowing on AMP tokens have been paused.
According to the latest update by the team, the attack cost a total of 460 million AMP tokens and 2804 ETH (valued at about $34 million).
The hacker executed the hack using a flash loan before exploiting the reentrancy bug. Reentrancy-based vulnerabilities are one of the most common types of security bugs in smart contracts.
Cream Finance is a lending and borrowing protocol that takes inspiration from Compound. It forked the DeFi blue chip and added different asset pools and its own governance token. AMP used the ERC-1820 (based on ERC-777) token standard, which allowed for a reentrancy function.
Smart contract security firm PeckShield, which led the initial analysis, told Crypto Briefing that there might be a “composability risk between Compound-based lending protocols and ERC-777-like tokens”.
PeckShield’s analysis shows that the exploit began when the hacker took out a flash loan of 500 ETH and deposited it as collateral to borrow 19 million AMP tokens. Then, the hacker re-borrowed 355 ETH by leveraging the reentrancy bug. The hacker self-liquidated the loan and repeated the process multiple times to extract funds.
The CREAM token has suffered a relatively minor hit in the fallout, trading down 4.8% at about $167.
Update: The estimated total value of the stolen cryptoassets has been updated to reflect the latest information.
Share this article
