Cream Finance v2
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 8 → 44. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −10, problems around the subject, caused by others −4.8; legitimacy credit long-running +4; the penalty for incidents it suffered is capped at 20. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -10 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -4.8 |
| Long-running | +4 |
| Sum | 34 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 44/100 (kept between 0 and 100)
How scoring works →Summary
Cream Finance (C.R.E.A.M.) is a decentralized lending protocol built on Ethereum, launched in August 2020 as a fork of Compound and Balancer. The protocol suffered three separate security breaches in 2021 totaling an estimated $185–195 million in losses, culminating in an October 27, 2021 flash loan attack on Cream v1 markets that drained approximately $130 million through oracle price manipulation of its yUSDVault integration with Yearn Finance. The serial nature of these incidents — involving flash loan exploits, reentrancy bugs, and oracle vulnerabilities across distinct attack vectors — established Cream Finance as one of the most frequently exploited DeFi protocols in the 2021 cycle.
Connected Entities
7 entities · 60 linked investigations- Cream Finance→mentioned with→Ethereum(70%)
- Yearn Finance→mentioned with→Ethereum(70%)
- Balancer→mentioned with→Ethereum(70%)
- Fantom (Sonic Labs)→mentioned with→Balancer(70%)
- Cream Finance→mentioned with→Fantom (Sonic Labs)(60%)
- Cream Finance v2→mentioned with→Yearn Finance(80%)
- Cream Finance→mentioned with→Yearn Finance(80%)
- Cream Finance v2→mentioned with→Cream Finance(80%)
- Fantom (Sonic Labs)→mentioned with→Yearn Finance(80%)
- Cream Finance v2→mentioned with→Poly Network(80%)
- + 5 more
Timeline(12 events)
3 August 2020
Cream Finance launches on Ethereum mainnet with YOLO Alpha mining pool. CREAM governance token issued.
CoinBureau Cream Finance ReviewNovember 2020
Cream Finance and Yearn Finance announce partnership to jointly develop the Iron Bank, a protocol-to-protocol uncollateralized lending facility.
Introducing The Iron Bank — Medium (C.R.E.A.M. Finance)27 January 2021
Trail of Bits completes security audit of Cream v1 and v2 Iron Bank, focusing on oracle manipulation and borrowing cap risks. Two significant issues identified: centralization of control and documentation gaps.
Trail of Bits Audit Announcement — Cream Finance Medium4 February 2021
CREAM token reaches all-time high of approximately $368.
Capital.com: Cream Finance price prediction13 February 2021
First exploit: Flash loan attack on Cream Finance's Iron Bank via Alpha Homora v2 integration results in approximately $37.5 million in losses. CREAM token drops ~30% within one hour.
CoinDesk: DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack31 August 2021
Second exploit: AMP token ERC-777 reentrancy attack drains 462,079,976 AMP tokens and 2,804.96 ETH, valued at approximately $18.8–29 million. Cream commits 20% of future protocol fees to repayment.
C.R.E.A.M. Finance Post Mortem: AMP Exploit (official)8 October 2021
Cream Finance and Yearn Finance announce launch of Iron Bank on Fantom, deepening cross-chain integration.
C.R.E.A.M. Finance x Yearn Finance Partnership — Smart Liquidity Research27 October 2021
Third and largest exploit: Flash loan oracle manipulation via yUSDVault pricePerShare inflation drains approximately $130 million from Cream Ethereum v1 markets across 68 token types. Attack transaction: 0x0fe2542079644e107cbf13690eb9c2c65963ccb79089ff96bfaf8dced2331c92.
C.R.E.A.M. Finance Post Mortem: Flash Loan Exploit Oct 27 (official)27 October 2021
Cream Finance suspends all Ethereum v1 market interactions and locks crToken transfers within ~6 hours of the attack. Yearn Finance recovers $9.42M from yUSD vault and forwards to Cream multisig.
Yearn Security Disclosure 2021-10-27November 2021
Cream Finance announces compensation plan: 1.45 million team CREAM tokens ($68M value) redistributed proportionally to uninsured hack victims. 10% bug bounty offered to attacker contingent on fund return.
CryptoPotato: Hacked C.R.E.A.M. Finance Promises to Repay Users15 March 2022
CREAM token trading at approximately $41, down ~88% from its February 2021 all-time high of $368.
Capital.com: Cream Finance price prediction30 January 2023
October 2021 exploit attacker moves 365.69 ETH (~$600,000) from known exploit wallet (0x70747df6ac244979a2ae9ca1e1a82899d02bbea4) to a new address, 16+ months after the hack.
NewsBTC: Cream Finance Exploiter Moving Funds Over 16 Months After HackDecision Log
- slot 455360699 · hash 7ZNUViCCkZrEKpH8JKzEP4aWJY79pinPEguEASz2k6eg
- slot 423162047 · hash 8CJpaNavBwEtVanG4z792rXnSp3NQ1bzrhJx2Fc2n45N
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/30/2026, 1:04:21 PM
last updated: 10/10/2026, 6:41:38 PM
4 viewsavoid.net — verified advice for a post-truth world