![\"Cream\"](\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2021\/08\/shutterstock_2015522714.jpg\")
<\/p>\n<\/p>\n
Cream finance, a defi borrowing and lending protocol, has been the victim of a hack that erased more than $29 million from its vaults. The attacker took advantage of a loophole in the implementation for adding the amp token to the protocol. This is the second time the platform has been involved in a hack. The first breach happened in February, when Cream lost $37.5 million.<\/strong><\/p>\n Cream protocol<\/a>, a defi lending-borrowing platform present on four different chains (Ethereum, BSC, Polygon, and Fantom), suffered a hack<\/a> Monday that resulted in the loss of $29 million in several cryptocurrencies. The attacker took advantage of a bug caused by the introduction of the amp token into the protocol. According to Peckshield<\/a>, a blockchain security and data analytics company, the hack was perpetrated<\/a> in just one transaction, taking advantage of a reentrancy bug present in the code of the amp currency.<\/p>\n This allowed the hacker to re-borrow assets during the transfer before updating the first borrow. The exploit was repeated 17 times and allowed the hacker to get ahold of 418,311,571 amp (worth $25.1 million) and 1,308.09 ethereum (worth $4.15 million)<\/i>. The platform had been audited by Trails Of Bits, a cybersecurity research and consulting firm, prior to the inclusion of the amp token.<\/p>\n Cream declared<\/a> it stopped the exploit by pausing supply and borrow on amp. The protocol also informed users that no other markets were affected, and that it was expecting to offer a post mortem report at a later date.<\/p>\n <\/ins> <\/ins> <\/p>\n This is not the first time Cream has suffered a hacking incident. Less than six months ago, the platform was also affected<\/a> by a hack that allowed the attacker to withdraw $37.5 million. The hack, using an unreleased version of a contract of Alpha Finance, another defi protocol, exploited a rounding miscalculation in the code and a whitelisting function. After taking control of the funds, the attacker took them to Tornado.cash, a protocol that allows private transactions in Ethereum.<\/p>\n Luckily, no user funds were affected during this first hack. However, it shows that the defi environment is very complex and that even a small change in protocol (like adding a currency or whitelisting another platform) can have a big impact on security in the future.<\/p>\nCream Protocol Suffers Hack<\/h2>\n
Not the First Time<\/h2>\n