# Cream Finance Insufficient Validation Bugfix Review

Cream Finance rewards contract failed to validate claim eligibility, letting attackers mint 6% APY CREAM rewards repeatedly by cycling CRV through fresh wallets.

- Payout: $20,750
- Severity: critical
- Program: Cream Finance
- Credited: Azeem
- Disclosed: 2021-07-03
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/cream-finance-insufficient-validation-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-cream-finance-insufficient-validation-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm technique:legacy-endpoint vuln:access-control vuln:business-logic

**Target:** Comptroller liquidity mining rewards contract
**Root cause:** The Comptroller did not validate whether a rewards claimant had actually participated in the liquidity mining program from the appropriate time, so new wallets could claim an instant 6% APY mint up front.
**Steps:**
1. Deposit CRV into Cream Finance via the new interface
2. Navigate to Classic.cream.finance/rewards to trigger instant 6% APY mint in CREAM (only CRV, once per wallet)
3. Swap CRV to ETH
4. Send ETH to a new wallet
5. Swap back to CRV
6. Repeat to mint another instant 6% APY in CREAM using the same CRV until contract drained
**How found:** Azeem became aware of a vulnerability circulating in the wild and reported it; the flaw was a missing check on whether a claimant had participated in the program from the appropriate time, with no unit test covering it.
**Exploitation:** Attacker deposits CRV, claims the up-front 6% APY CREAM mint, converts to ETH, moves to a fresh wallet, converts back to CRV, and repeats—recycling the same capital to drain the discontinued rewards contract (~$100k TVL).
**Escalation:** Repeating the cycle across fresh wallets scales extraction until the contract is fully drained.
**Insight:** Discontinued/legacy rewards contracts that still pay out are prime targets: check whether claim eligibility is validated against participation history, and test whether per-wallet limits can be bypassed by cycling the same capital through fresh addresses.