Skip to content

The Cream Finance hack — $130M lost

Loss$130M
Date27 Oct 2021
ChainEthereum
Failure classOracle manipulation
In assetsfifth incident that year
Targetlending market
1

What happened

Cream priced Yearn vault shares as totalAssets / totalSupply, read live from the vault. A vault's asset balance counts tokens that were simply sent to it — no mint required. So the attacker used flash loans to shrink the vault's supply to about $8M, then donated ~$8M of yUSD straight into the vault, instantly doubling the price per share without a single trade. His $1.5B of crYUSD collateral was revalued at $3B, and he borrowed out everything Cream had on the shelf.

2

How the attack ran

  1. Flash-loan, then burn sharesVault supply squeezed down to ~$8M
  2. Transfer $8M into the vaultA plain ERC-20 transfer — no mint, no swap, no fee
  3. Price = balance() / totalSupplyA donation doubles the price per share instantly
  4. $1.5B collateral reads $3BBorrow out everything on the shelf — $130M
3

The code

PriceOracleProxy → yVault.getPricePerFullShare()
// Cream's price for a vault-share collateral token:
function getUnderlyingPrice(CToken cToken) returns (uint) {
    ...
    return vault.getPricePerFullShare() * underlyingPrice / 1e18;
}

// yVault:
function getPricePerFullShare() public view returns (uint) {
    return balance() * 1e18 / totalSupply;
    // ❌ balance() includes tokens TRANSFERRED in.
    //    A plain ERC-20 transfer moves the price. No mint. No swap. No fee.
}

// The attack, in one transaction:
  flash-loan → burn shares until totalSupply ≈ $8M
  transfer $8M of yUSD directly to the vault      → price per share ×2
  collateral repriced $1.5B → $3B                → borrow everything
4

What would have caught it

What an audit looks for: any price derived from a live balance is manipulable inside one transaction — this is the donation attack, and it is still landing today. Collateral must be priced from a manipulation-resistant oracle (TWAP or an independent feed), never from balanceOf(address(this)).
6

Sources

Every figure on this page comes from the post-mortems above, not from us. Losses are US dollars at the time of the incident.

Check your own contract for this

Oracle manipulation is one of the 203 classes the SaferICO scanner checks for. It will not review your signing process — but it will read your Solidity.

Run the scanner See how it is attacked Read the docs