Breaking: Cream Finance Gets Exploited For $37.5 million

Cream Finance or Iron Bank has become the latest defi protocol to fall victim to an exploit that possibly leads to a $37.5 million heist. The official Twitter handle of the protocol the issue and said that they were looking into it.

We are aware of a potential exploit and are looking into this. Thank you for your support as we investigate.

— Cream Finance ???? (@CreamdotFinance) February 13, 2021

The attacker managed to exploit a loophole for drawing loans and used Alpha Homora to draw sUSD from the collateral debt position. The hackers kept withdrawing loans larger than the previous one and used two transactions at a time whereas soon as they received the loan they used to send it back into the platform receiving cyUSD. The hacker managed to get a $1.8 million USDC loan from Aave v2 and since they were simultaneously sending back the drawn loan the cycle continued.

The hackers kept repeating this cycle until they hoarded enough cyUSD to borrow anything from the platform. In the end, the hacker borrowed,

• 13.2k WITH
• 3.6M USDC
• 5.6M USDT
• 4.2M DAI

The Hacker Still Holds 11k ETH in the Wallet

The hacker finally used the withdrawn amount of ETH and other tokens to fill the Aave v2 collateral debt position with stablecoins to return the loan that included,

• 1k ETH to IronBank deployer,
• 1k ETH to Homora deployer,
• 220 ETH to Tornado,
• 100 ETH granted to Tornado

Nearly 11k ETH remains on the exploiter balance now. This would mark another sophisticated exploit on a defi protocol which had increased significantly in 2020 as the popularity of the Defi ecosystem grew. Every other week one or the other defi protocol was hacked for millions where in some cases the stolen funds were returned however in most the exploiter got away with millions.

The Alpha Finance lab whose protocol was used for the exploitation has claimed that the breach had been patched. The firm has suspended any active position on Homora v2. The firm said, Users can’t borrow more funds from Alpha Homora v2 = no new leveraged positions and borrow on existing positions.

Users can't borrow more funds from Alpha Homora v2 = no new leveraged positions and borrow on existing positions.

V1 is safe and operational.

We're on full alert and working with @samczsun & many trusted builders to investigate the issues thoroughly.

A post mortem to follow.

— Alpha Finance Lab (@AlphaFinanceLab) February 13, 2021

“V1 is safe and operational We’re on full alert and working with @samczsun & many trusted builders to investigate the issues thoroughly. A post mortem to follow.”