DeFi Project Cream Finance Suffers $25 Million Exploit
Cream Finance has reported a major security attack, resulting in a $25 million loss.
Reentrancy Bug Behind Cream Finance Exploit
Cream Finance has been exploited.
The DeFi lending protocol reported its CREAM V1 market had been targeted Monday.
The hacker took advantage of a reentrancy bug on the token contract for AMP, a Consensys-backed digital collateral token listed within the dApp.
The exploit allowed the hacker to steal 41.8 million AMP tokens and 1308.09 ETH, currently worth about $25 million. The supply and borrowing on AMP tokens have been paused.
The hacker executed the hack using a flash loan before exploiting the reentrancy bug. Reentrancy-based vulnerabilities are one of the most common types of security bugs in smart contracts.
Cream Finance is a lending and borrowing protocol that takes inspiration from Compound. It forked the DeFi blue chip and added different asset pools and its own governance token. AMP used the ERC-1820 (based on ERC-777) token standard, which allowed for a reentrancy function.
Smart contract security firm PeckShield, which led the initial analysis, told Crypto Briefing that there might be a “composability risk between Compound-based lending protocols and ERC-777-like tokens”.
PeckShield’s analysis shows that the exploit began when the hacker took out a flash loan of 500 ETH and deposited it as collateral to borrow 19 million AMP tokens. Then, the hacker re-borrowed 355 ETH by leveraging the reentrancy bug. The hacker self-liquidated the loan and repeated the process multiple times to extract funds.
The CREAM token has suffered a relatively minor hit in the fallout, trading down 4.8% at about $167. While both Cream Finance and Peckshield are still investigating the attack, a post-mortem is due to follow soon.
The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.
You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.
See full terms and conditions.
Source: Read Full Article