Cream Finance Loses $25M in Flash Loan Attack

Decentralized finance (DeFi) lending platform CREAM Finance lost $25 million in a flash loan attack, the second in the past six months.

CREAM confirmed the exploitation, resulting in a loss of 418,311,571 in AMP and 1,308.09 in ETH.

Blockchain security company PeckShield Inc. first broke the news on Twitter, citing data from Etherscan. Shortly thereafter, Cream confirmed the exploit that resulted in a loss of 418,311,571 in AMP and 1,308.09 in ETH. Combined, this amounts to roughly $25 million at today’s exchange rates. While AMP seems to have suffered, falling 15% since the news broke, Ethereum remains relatively unaffected at around $3,200.

The platform also reportedly ceased the exploitation by pausing supply and borrowing on AMP. According to the initial investigation, with the help of PeckSheild, the exploit occurred through reentrancy on the AMP token contract.

Second attack in six months

The latest attack must be particularly frustrating for the DeFi lending platform, coming within just six months of another attack. In February, Cream experienced a similar flash loan attack losing roughly $37.5 million worth of cryptocurrency. Specifically, it lost 13,200 wETH, 3.6 million USDC, 5.6 million USDT, and 4.2 million DAI.

The funds had been exploited through Alpha Hamora, an Ethereum protocol for leveraging your position in yield farming pools. Alpha Labs then proceeded to work with YFI founder Andre Cronje and Cream Finance to investigate the stolen funds. At the time, a prime suspect had been identified.

CREAM developments

Cream introduced collateral-free protocol-to-protocol flash loans with Iron Bank. They were also significantly cheaper, with interest at 0.03% compared to 0.09% on AAVE and 0.3% on Uniswap. It also automated the entire process through smart contracts to prevent lenders from defaulting.

⏩ SOURCE