Nexo

Start Earning Up to 16% Interest Automatically

Learn More
Home » News » DeFi Project Cream Finance Suffers $34 Million Hack

DeFi Project Cream Finance Suffers $34 Million Hack

by

According to Cream Finance, the hack was executed "by way of reentrancy on the AMP token contract."

DeFi Project Cream Finance Suffers $34 Million Hack
Shutterstock cover by Foxys Forest Manufacture

Share this article

Cream Finance has reported a major hack that a $34 million loss, according to the team.

Reentrancy Bug Behind Cream Finance Exploit 

Cream Finance has been exploited.

The DeFi lending protocol reported its CREAM V1 market had been targeted Monday.

The hacker took advantage of a reentrancy bug on the token contract for AMP, a Consensys-backed digital collateral token listed within the dApp. The supply and borrowing on AMP tokens have been paused.

According to the latest update by the team, the attack cost a total of 460 million AMP tokens and 2804 ETH (valued at about $34 million).

The hacker executed the hack using a flash loan before exploiting the reentrancy bug. Reentrancy-based vulnerabilities are one of the most common types of security bugs in smart contracts.  

Cream Finance is a lending and borrowing protocol that takes inspiration from Compound. It forked the DeFi blue chip and added different asset pools and its own governance token. AMP used the ERC-1820 (based on ERC-777) token standard, which allowed for a reentrancy function.

Smart contract security firm PeckShield, which led the initial analysis, told Crypto Briefing that there might be a “composability risk between Compound-based lending protocols and ERC-777-like tokens”.

PeckShield’s analysis shows that the exploit began when the hacker took out a flash loan of 500 ETH and deposited it as collateral to borrow 19 million AMP tokens. Then, the hacker re-borrowed 355 ETH by leveraging the reentrancy bug. The hacker self-liquidated the loan and repeated the process multiple times to extract funds. 

The CREAM token has suffered a relatively minor hit in the fallout, trading down 4.8% at about $167.

Update: The estimated total value of the stolen cryptoassets has been updated to reflect the latest information.

Share this article

The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.

Crypto Briefing may augment articles with AI-generated content created by Crypto Briefing’s own proprietary AI platform. We use AI as a tool to deliver fast, valuable and actionable information without losing the insight - and oversight - of experienced crypto natives. All AI augmented content is carefully reviewed, including for factural accuracy, by our editors and writers, and always draws from multiple primary and secondary sources when available to create our stories and articles.

You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.

See full terms and conditions.