# Hack Analysis: Cream Finance Oct 2021

Cream Finance's yUSD hybrid oracle was inflated by donating Yearn 4-Curve LP tokens to the yUSD vault, letting attacker borrow $130m against fake collateral.

- Payout: Real-world hack
- Severity: critical
- Program: Cream Finance
- Credited: Immunefi
- Disclosed: 2022-11-09
- Write-up quality: 9/10
- Original: https://immunefi.com/blog/bug-fix-reviews/hack-analysis-cream-finance-oct-2021/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-cream-finance-oct-2021
- Tags: domain:web3 impact:funds-loss kind:incident platform:immunefi sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** Compound-fork lending protocol yUSD market and Yearn yUSD vault oracle
**Root cause:** Cream's yUSD price oracle derives value from Yearn yUSD vault pricePerShare, which is manipulable by donating Curve LP tokens directly to the vault; combined with uncapped recursive supply of the same yUSD collateral, account health is faked.
**Steps:**
1. Flash mint 500m DAI from MakerDAO DssFlash `0x1EB4CF3A948E7D72A198fe073cCb8C7a948cD853`
2. Deposit DAI into Curve y4 pool via depositor `0xbBC81d23Ea2c3ec7e56D39296F0cbB648873a5d3`, then deposit LP into Yearn yUSD vault `0x4B5BfD52124784745c1071dcB244C6688d2533d3`
3. Deposit yUSD into Cream cryUSD `0x4BAa77013ccD6705ab0522853cB0E9d453579Dd4`
4. Flash loan ~524k ETH from AAVE V2 `0x7d2768dE32b0b80b7a3454c06BdAc94A69DDc7A9`
5. From Contract B deposit ETH into Cream cETH and borrow all yUSD, send to Contract A; repeat deposit/borrow recursion twice to triple supplied yUSD
6. Withdraw yUSD from Yearn vault, then `IERC20(curveDepositToken).transfer(yusd, startYusd)` to donate LP and double pricePerShare
7. Borrow all ETH and all tokens across Cream markets (cDAI, cUSDC, cUSDT, cFEI, cPERP, cRUNI, etc.)
8. Withdraw remaining Curve LP to DAI, wrap ETH, swap via UniswapV2 and Curve 3pool to repay AAVE and MakerDAO loans, keep profit
**How found:** Analysis of the on-chain attack transaction; identified that Cream's yUSD oracle reads Yearn vault pricePerShare, which is directly manipulable by transferring LP tokens to the vault, and that Cream lacked a supply cap allowing recursive collateral inflation.
**Exploitation:** Attacker used two contracts: Contract A flash-minted 500m DAI and flash-borrowed ~524k ETH, converted DAI to yUSD, supplied it to Cream, then used Contract B's ETH collateral to recursively borrow yUSD back and re-supply it, inflating apparent collateral to ~$3b. Donating ~$10m Curve LP to the yUSD vault doubled pricePerShare, making the oracle value yUSD at $2. Attacker then borrowed all available liquidity across Cream markets, swapped proceeds to DAI/WETH, repaid flash loans, and exited with ~$130m.
**Escalation:** Recursive re-supply of borrowed yUSD multiplied collateral; oracle donation doubled pricePerShare, converting a $500m position into $3b of borrowing power to drain every market.
**Insight:** For Compound forks, check whether any listed cToken's oracle reads a vault share price (pricePerShare/totalAssets) that can be inflated by direct token donation to the vault; also check for missing supply caps enabling recursive re-supply of borrowed collateral.