A hacker withdrew cryptoassets from the DeFi Cream Finance platform to $25.6 млн – Bits Media

DeFi Cream Finance is yet another victim of a quick loan attack. The hacker brought out more 418 million AMP management tokens and 1 308 ETH.

The developers of the Cream Finance decentralized finance platform reported this morning
on twitter, that the C.R.E.A.M market. v1 Ethereum was attacked. Removed from the platform 418 311 571 AMP and 1,308.09 ETH as a result of re-entering the AMP token contract.

C.R.E.A.M. v1 market on Ethereum has suffered an exploit, resulting in a loss of 418,311,571 in AMP and 1,308.09 in ETH, by way of reentrancy on the AMP token contract.
We have stopped the exploit by pausing supply and borrow on AMP. No other markets were affected.
— Cream Finance (@CreamdotFinance) August 30, 2021

The total dollar value of stolen crypto assets exceeds $25.6 million. According to Coinmarketcap, the price of the AMP protocol governance token has decreased by 15% as a result of the attack. To addresses
the attacker is now in possession of crypto assets worth more than $18 million. The Cream Finance team has suspended
loans in AMP, to avoid further losses.

Cream Finance – decentralized finance platform (DeFi), which allows users to receive interest from lending crypto assets. Cream Finance is a fork of the Compound codebase.

PeckShield analysts explained, that the hacker managed to get a quick loan in the amount of 500 ETH. He used it to expose the capabilities of the "reentrant error" vulnerability., detected in the Ampleforth smart contract.

2/4 The hack is made possible due to a reentrancy bug introduced by $AMP, which is an ERC777-like token and exploited to re-borrow assets during its transfer before updating the first borrow. pic.twitter.com/oVg0w1FWFt
— PeckShield Inc. (@peckshield) August 30, 2021

Yesterday the decentralized finance project xToken was hacked
for the second time in a year. The attackers found a vulnerability in the XSNX smart contract and brought tokens to $4.5 million.