Alpha Finance/Cream Finance

Flash loan attack

Estimated loss

$37.50M

VERDICT —UNRATED

Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.

▰ METHOD

FLASHLOAN

FLASHLOANBYTECODE CATCHABLE →AI SCANNABLE →

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

The attacker uses Lightning Loan to Alpha Finance for leveraged lending, and uses Alpha Finance’s own Cream IronBank quota to return the Lightning Loan. In this process, the attacker obtains a large amount of cySUSD by adding liquidity to Cream, allowing the attacker to use it. These cySUSD are further borrowed in Cream Finance. Due to problems with Alpha Finance, both agreements suffered losses at the same time. Attack method (per SlowMist): Flash loan attack. Reported loss: $ 37,500,000.

Primary source

https://medium.com/cream-finance/alpha-homora-v2-exploit-post-mortem-344d277bdea6 ↗

Sourced from

slowmist

Technical record