Cream Finance v2
Summary
Cream Finance (C.R.E.A.M.) is a decentralized lending protocol built on Ethereum, launched in August 2020 as a fork of Compound and Balancer. The protocol suffered three separate security breaches in 2021 totaling an estimated $185–195 million in losses, culminating in an October 27, 2021 flash loan attack on Cream v1 markets that drained approximately $130 million through oracle price manipulation of its yUSDVault integration with Yearn Finance. The serial nature of these incidents — involving flash loan exploits, reentrancy bugs, and oracle vulnerabilities across distinct attack vectors — established Cream Finance as one of the most frequently exploited DeFi protocols in the 2021 cycle.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(12 events)
2020-08-03
Cream Finance launches on Ethereum mainnet with YOLO Alpha mining pool. CREAM governance token issued.
CoinBureau Cream Finance Review2020-11-01
Cream Finance and Yearn Finance announce partnership to jointly develop the Iron Bank, a protocol-to-protocol uncollateralized lending facility.
Introducing The Iron Bank — Medium (C.R.E.A.M. Finance)2021-01-27
Trail of Bits completes security audit of Cream v1 and v2 Iron Bank, focusing on oracle manipulation and borrowing cap risks. Two significant issues identified: centralization of control and documentation gaps.
Trail of Bits Audit Announcement — Cream Finance Medium2021-02-04
CREAM token reaches all-time high of approximately $368.
Capital.com: Cream Finance price prediction2021-02-13
First exploit: Flash loan attack on Cream Finance's Iron Bank via Alpha Homora v2 integration results in approximately $37.5 million in losses. CREAM token drops ~30% within one hour.
CoinDesk: DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack2021-08-31
Second exploit: AMP token ERC-777 reentrancy attack drains 462,079,976 AMP tokens and 2,804.96 ETH, valued at approximately $18.8–29 million. Cream commits 20% of future protocol fees to repayment.
C.R.E.A.M. Finance Post Mortem: AMP Exploit (official)2021-10-08
Cream Finance and Yearn Finance announce launch of Iron Bank on Fantom, deepening cross-chain integration.
C.R.E.A.M. Finance x Yearn Finance Partnership — Smart Liquidity Research2021-10-27
Third and largest exploit: Flash loan oracle manipulation via yUSDVault pricePerShare inflation drains approximately $130 million from Cream Ethereum v1 markets across 68 token types. Attack transaction: 0x0fe2542079644e107cbf13690eb9c2c65963ccb79089ff96bfaf8dced2331c92.
C.R.E.A.M. Finance Post Mortem: Flash Loan Exploit Oct 27 (official)2021-10-27
Cream Finance suspends all Ethereum v1 market interactions and locks crToken transfers within ~6 hours of the attack. Yearn Finance recovers $9.42M from yUSD vault and forwards to Cream multisig.
Yearn Security Disclosure 2021-10-272021-11-01
Cream Finance announces compensation plan: 1.45 million team CREAM tokens ($68M value) redistributed proportionally to uninsured hack victims. 10% bug bounty offered to attacker contingent on fund return.
CryptoPotato: Hacked C.R.E.A.M. Finance Promises to Repay Users2022-03-15
CREAM token trading at approximately $41, down ~88% from its February 2021 all-time high of $368.
Capital.com: Cream Finance price prediction2023-01-30
October 2021 exploit attacker moves 365.69 ETH (~$600,000) from known exploit wallet (0x70747df6ac244979a2ae9ca1e1a82899d02bbea4) to a new address, 16+ months after the hack.
NewsBTC: Cream Finance Exploiter Moving Funds Over 16 Months After HackDecision Log
- hash: 8CJpaNavBwEtVanG4z792rXnSp3NQ1bzrhJx2Fc2n45N
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/30/2026, 1:04:21 PM
last updated: 5/30/2026, 1:04:27 PM
avoid.net — verified advice for a post-truth world