DeFi Platform Cream Finance Lost $29 Million Due to Hacking

A hack of Cream Finance, a defi borrowing and lending protocol, resulted in the loss of more than $29 million from its vaults. The attacker took advantage of a loophole in the implementation for adding the amp token to the protocol. This is the second time that the platform has been hacked. Cream lost $37.5 million in the first hack, which occurred in February.

Cream Protocol Suffers Hack

Cream protocol, a decentralized lending and borrowing platform that operates on four distinct chains (Ethereum, BSC, Polygon, and Fantom), was hacked on Monday, resulting in the theft of $29 million in various cryptocurrencies. The attacker took advantage of a flaw in the protocol created by the addition of the amp token. According to Peckshield, a blockchain security and data analytics firm, the hack was carried out in a single transaction, using a reentrancy flaw in the amp currency's code.

The hacker was able to re-borrow assets throughout the transfer without having to update the original borrow. The hacker was able to obtain 418,311,571 amp (valued $25.1 million) and 1,308.09 ethereum (worth $4.15 million) by repeating the vulnerability 17 times. Prior to the introduction of the amp token, the platform has been examined by Trails Of Bits, a cybersecurity research and consulting organization.

Cream announced that it has put a stop to the exploit by halting supply and borrowing on amp. The procedure also said that no other markets were impacted and that a post-mortem report will be released at a later time.

Not the First Time

This isn't the first time Cream's website has been hacked. A breach on the site occurred less than six months ago, allowing the attacker to withdraw $37.5 million. Using an unpublished version of an Alpha Finance contract, another defi protocol, the hack took advantage of a rounding miscalculation in the code as well as a whitelisting function. After seizing the money, the attacker transferred them to Tornado.cash, an Ethereum protocol that allows for private transactions.

Fortunately, no user money was compromised in the initial breach. However, it demonstrates that the defi ecosystem is extremely complicated, and that even minor protocol changes (such as introducing a currency or whitelisting another platform) can have a significant influence on future security.