Cream Finance v2
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2hxjf3…skYnSummary
Cream Finance (C.R.E.A.M.) is a decentralized lending protocol built on Ethereum, launched in August 2020 as a fork of Compound and Balancer. The protocol suffered three separate security breaches in 2021 totaling an estimated $185–195 million in losses, culminating in an October 27, 2021 flash loan attack on Cream v1 markets that drained approximately $130 million through oracle price manipulation of its yUSDVault integration with Yearn Finance. The serial nature of these incidents — involving flash loan exploits, reentrancy bugs, and oracle vulnerabilities across distinct attack vectors — established Cream Finance as one of the most frequently exploited DeFi protocols in the 2021 cycle.
Connected Entities
1 entities- + 1 more
Timeline(12 events)
3 August 2020
Cream Finance launches on Ethereum mainnet with YOLO Alpha mining pool. CREAM governance token issued.
CoinBureau Cream Finance ReviewNovember 2020
Cream Finance and Yearn Finance announce partnership to jointly develop the Iron Bank, a protocol-to-protocol uncollateralized lending facility.
Introducing The Iron Bank — Medium (C.R.E.A.M. Finance)27 January 2021
Trail of Bits completes security audit of Cream v1 and v2 Iron Bank, focusing on oracle manipulation and borrowing cap risks. Two significant issues identified: centralization of control and documentation gaps.
Trail of Bits Audit Announcement — Cream Finance Medium4 February 2021
CREAM token reaches all-time high of approximately $368.
Capital.com: Cream Finance price prediction13 February 2021
First exploit: Flash loan attack on Cream Finance's Iron Bank via Alpha Homora v2 integration results in approximately $37.5 million in losses. CREAM token drops ~30% within one hour.
CoinDesk: DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack31 August 2021
Second exploit: AMP token ERC-777 reentrancy attack drains 462,079,976 AMP tokens and 2,804.96 ETH, valued at approximately $18.8–29 million. Cream commits 20% of future protocol fees to repayment.
C.R.E.A.M. Finance Post Mortem: AMP Exploit (official)8 October 2021
Cream Finance and Yearn Finance announce launch of Iron Bank on Fantom, deepening cross-chain integration.
C.R.E.A.M. Finance x Yearn Finance Partnership — Smart Liquidity Research27 October 2021
Third and largest exploit: Flash loan oracle manipulation via yUSDVault pricePerShare inflation drains approximately $130 million from Cream Ethereum v1 markets across 68 token types. Attack transaction: 0x0fe2542079644e107cbf13690eb9c2c65963ccb79089ff96bfaf8dced2331c92.
C.R.E.A.M. Finance Post Mortem: Flash Loan Exploit Oct 27 (official)27 October 2021
Cream Finance suspends all Ethereum v1 market interactions and locks crToken transfers within ~6 hours of the attack. Yearn Finance recovers $9.42M from yUSD vault and forwards to Cream multisig.
Yearn Security Disclosure 2021-10-27November 2021
Cream Finance announces compensation plan: 1.45 million team CREAM tokens ($68M value) redistributed proportionally to uninsured hack victims. 10% bug bounty offered to attacker contingent on fund return.
CryptoPotato: Hacked C.R.E.A.M. Finance Promises to Repay Users15 March 2022
CREAM token trading at approximately $41, down ~88% from its February 2021 all-time high of $368.
Capital.com: Cream Finance price prediction30 January 2023
October 2021 exploit attacker moves 365.69 ETH (~$600,000) from known exploit wallet (0x70747df6ac244979a2ae9ca1e1a82899d02bbea4) to a new address, 16+ months after the hack.
NewsBTC: Cream Finance Exploiter Moving Funds Over 16 Months After HackDecision Log
- hash: 8CJpaNavBwEtVanG4z792rXnSp3NQ1bzrhJx2Fc2n45N
This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/30/2026, 1:04:21 PM
last updated: 7/25/2026, 10:30:08 AM
3 viewsavoid.net — verified advice for a post-truth world