VERDICT —UNRATED
Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.
Root cause
Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.
▰ PROOF OF CONCEPT
DEFIHACKLABS
src/test/2021-08/Cream_exp.sol
view forked test on github ↗Reproducible Foundry test fork from SunWeb3Sec/DeFiHackLabs. Clone the repo, run forge test against the file path above, and replay the exploit against a mainnet fork at the historical block. Use for reproduction only — not for live targets.
Forensic narrative
An unknown hacker has managed to gain $18.8 million in the latest flash loan exploit of the Cream Finance protocol through a reentrancy bug introduced by the Amp (AMP) token, according to an investigation by blockchain security firm Peckshield. Reported loss: $19,000,000.
Primary source
https://cointelegraph.com/news/cream-finance-defi-platform-loses-19m-in-a-flash-loan-hack ↗Sourced from
chainsec
Technical record
- chain
- —
- protocol
- Cream Finance
- bug_class
- reentrancy
- date_occurred
- 2021-08-30
- loss_usd
- $19,000,000
- source_id
- cs:cream-finance::2021-08-30
Related — same bug class· reentrancy