OAK — OnChain Attack Knowledge

Worked example · 2021-10

Cream Finance oracle manipulation — Ethereum — 2021-10-27

Loss
~$130M extracted from Cream's lending pools (the third and largest of three Cream Finance incidents in 2021).
OAK Techniques observed
OAK-T9.001 (Oracle Price Manipulation) — primary; OAK-T9.002 (Flash-Loan-Enabled Exploit) as the precondition without which the extraction would not have scaled.
Attribution
pseudonymous attacker; no public named-individual attribution. Proceeds were moved on-chain after the event; no recovery negotiation reached the public record.
Key teaching point
Cream October 2021 is a useful T9.001 + T9.002 case study because the oracle-architecture failure mode is unusually clean and the recurrence pattern across the same calendar year provides a ready-made teaching case for the difference between incident-level and posture-level risk. The vulnerability is one design choice — pricing a vault share by reading on-chain vault_total_value / vault_total_supply — combined with one missing safeguard — no resistance to direct-transfer manipulation of either side of the ratio. The dollar loss is bounded by the available borrowing liquidity in the consuming protocol rather than by the attacker's borrowing power, which is a generic property of T9.001 + T9.002 chains and a useful framing fact for contributors estimating worst-case loss in similarly-shaped surfaces. Post-Cream, lending protocols broadly moved away from book-value-of-vault oracles for permissionlessly-listed collateral, and the standing-surface contracted as the standard oracle-design pattern improved — though, as Mango Markets (2022) and subsequent incidents demonstrated, the T9.001 family is not retired, and the spot-price-of-thin-venue sub-pattern remains a live surface. Contributors writing other T9.001 examples should prefer cases where the oracle-architecture facts are documented in detail and where the failure mode is mechanically distinct from existing canonical cases, since the family is broad enough that taxonomic clarity depends on resolving the sub-patterns explicitly.

Summary

Cream Finance was an Ethereum-based permissionless lending protocol (a Compound fork) that supported a long tail of collateral assets, including Yearn vault share tokens (yUSDVault, also referred to in some write-ups as the Yearn yUSD vault token). Cream's PriceOracleProxy priced yUSDVault as vault_total_value / vault_total_supply — a per-share book-value computation that read the vault's assets and supply directly from on-chain state. On 2021-10-27, an attacker used flash-loan-funded working capital (DAI from MakerDAO and ETH from Aave) to (a) build a very large yUSDVault collateral position at Cream, and (b) atomically distort the per-share denominator-and-numerator pair that the oracle used. By redeeming most of the yUSDVault supply down to a thin residual and then donating yUSD directly into the vault, the attacker doubled the reported per-share value within the same transaction. The inflated collateral was then used to borrow every remaining asset across Cream's lending pools, capped at ~$130M by the available pool liquidity rather than by the attacker's borrowing power. Forensic write-ups by Halborn, Immunefi, ImmuneBytes, and independent researcher Mudit Gupta converged on the same root-cause description: a book-value oracle on a manipulable single-vault denominator, executed inside the atomicity window of a flash loan.

This was the third Cream Finance incident in 2021. Cream's earlier 2021 incidents — ~$37M via the Alpha Homora / Iron Bank exploit in February 2021, and ~$19M via an AMP-token (ERC-777) reentrancy callback in August 2021 — exploited different Techniques, but the recurrence of distinct root causes against the same protocol is itself a structural observation: a permissionless-listing posture combined with broad asset coverage produces a wide standing T9 surface, and the per-incident technical details vary while the protocol-level risk profile does not. Cream Finance effectively wound down operations after the October 2021 incident.

Timeline (UTC)

When Event OAK ref
2021-02 Alpha Homora exploit via Cream's Iron Bank — ~$37M (separate root cause) (prior incident, T9-class)
2021-08-30 AMP-token (ERC-777) reentrancy callback drains ~$19M; copycat follow-on attack (prior incident, T9.005-adjacent)
2021-10-27 (T+0) Attacker contract initiates the exploit transaction T9.002 setup
2021-10-27 (same tx) DAI flash-borrowed from MakerDAO; ETH flash-borrowed from Aave T9.002 precondition
2021-10-27 (same tx) Borrowed DAI deposited into Curve's yPool to mint yDAI; yDAI used to mint yUSD; yUSD deposited into the yUSDVault to acquire yUSDVault shares as Cream collateral T9.001 setup
2021-10-27 (same tx) Account 1 supplies yUSDVault to Cream as collateral; Account 2 (or same account, sources differ) prepares to borrow against the manipulated price T9.001 setup
2021-10-27 (same tx) Most of yUSDVault redeemed back to yUSD, collapsing the vault's total_supply to a thin residual T9.001 oracle-side move (denominator)
2021-10-27 (same tx) Approximately $8M of yUSD donated directly into the vault, increasing the vault's total_value without minting paired shares T9.001 oracle-side move (numerator)
2021-10-27 (same tx) PriceOracleProxy.getUnderlyingPrice(yUSDVault) now reports ~2x the pre-manipulation per-share value T9.001 oracle effect
2021-10-27 (same tx) Inflated yUSDVault collateral used to borrow every available asset across Cream's lending pools — ~$130M total, capped by pool liquidity T9.001 extraction
2021-10-27 (same tx) Flash loans repaid; ~$130M retained T9.002 closure
2021-10-27 (post-event) Cream protocol team and community confirm the loss; pause and remediation discussed in protocol channels (defender response)
2021-10-27 onward Proceeds moved on-chain; no public recovery negotiation (post-event)

What defenders observed

  • Pre-event (oracle-design layer): Cream priced yUSDVault as vault_total_value / vault_total_supply directly from on-chain state, with no TWAP window, no minimum-supply floor, and no resistance to direct-transfer manipulation of either the numerator (donate-to-vault) or the denominator (mass redemption). This was a standing T9.001 surface from the day yUSDVault was added as collateral. Cream's permissionless-listing posture extended this same surface across a long tail of similarly book-value-priced LP and vault tokens.
  • Pre-event (recurrence pattern): Cream had already taken two distinct exploits in 2021 (Feb ~$37M, Aug ~$19M), each with a different root cause. From a defender-portfolio perspective, the February and August incidents were a leading indicator that the protocol's standing-surface profile — wide collateral coverage, fast permissionless integration, lender-of-last-resort positioning for the long tail of yield tokens — was structurally distinct from peer protocols' (Compound, Aave) and warranted distinct counterparty-risk treatment. This is a portfolio-level T9-class signal, not a per-incident detection signal.
  • At-event (oracle-side signal): within the exploit transaction, the yUSDVault total_supply collapsed and total_value jumped within the same atomic context. A direct-transfer-aware vault-state monitor on the yUSD vault would have observed the imbalance in the same block, but mitigation at that horizon requires either a circuit breaker on the consuming protocol (Cream) or a per-block sanity check on the price feed (TWAP-windowed price with deviation bounds).
  • At-event (protocol-side signal): the same actor was both the marginal supplier of yUSDVault collateral and the marginal borrower against it, in the same transaction, with flash-loan-funded working capital. A cross-action correlation detector on Cream — same actor, supply-then-immediately-borrow-against, flash-loan-bracketed window — would have produced an independent signal, again only useful if mitigation included same-block intervention.
  • Post-event (recovery channel): unlike Mango Markets (2022) and Euler Finance (2023), no recovery negotiation reached the public record. The base-rate expectation for a successful T9.001 extraction with on-chain laundering is total loss; Cream October 2021 fits that base rate.

What this example tells contributors writing future Technique pages

  • T9.001 + T9.002 is the canonical pre-2022 pairing. Cream October 2021, alongside Harvest Finance October 2020 and several pre-2022 lending exploits, established the template for what later became the modern T9.001 case (Mango Markets 2022). Worked examples for T9.001 should distinguish the oracle-architecture sub-pattern: book-value-of-vault oracles (Cream October 2021) are mechanically distinct from spot-price-of-thin-venue oracles (Mango Markets 2022), and the mitigations differ. A book-value oracle is fixed by adding direct-transfer-resistance (track accounted balances, not contract balances) and minimum-supply floors; a spot-price oracle is fixed by TWAP windows, deviation breakers, and multi-venue input quorum. T9.001 pages should describe both sub-patterns.
  • "Permissionless listing" is itself a standing-surface modifier. Cream's three 2021 incidents are not three independent bad-luck events; they are three distinct realisations of the same wide-collateral-coverage posture. Worked examples should resist treating recurring-target patterns as coincidence — a protocol that takes one T9-class incident and continues operating with the same listing posture is reporting that the standing surface is unchanged. Contributors writing T9 case studies should note when a protocol has a recurrence history, since this changes how the case should be cited as evidence in mitigation guidance.
  • Flash loans are the precondition, not the cause. As with Beanstalk (T9.002 + T9.003) and Euler (T9.002 + T9.004), Cream's October 2021 incident is enabled by flash loans but caused by the oracle design. Banning flash loans does not retire the T9.001 surface; only fixing the oracle does. Worked examples should keep this distinction tight, since "ban flash loans" is a recurring downstream-distortion mitigation suggestion that misallocates defender effort.
  • Pseudonymous attribution and on-chain-only laundering is the v0.1 norm for T9.001. Mango Markets is the exception (public self-identification + civil litigation); Cream October 2021 is the rule. Worked examples should not assume a recovery channel exists.

Public references

Discussion

Cream October 2021 is a useful T9.001 + T9.002 case study because the oracle-architecture failure mode is unusually clean and the recurrence pattern across the same calendar year provides a ready-made teaching case for the difference between incident-level and posture-level risk. The vulnerability is one design choice — pricing a vault share by reading on-chain vault_total_value / vault_total_supply — combined with one missing safeguard — no resistance to direct-transfer manipulation of either side of the ratio. The dollar loss is bounded by the available borrowing liquidity in the consuming protocol rather than by the attacker's borrowing power, which is a generic property of T9.001 + T9.002 chains and a useful framing fact for contributors estimating worst-case loss in similarly-shaped surfaces. Post-Cream, lending protocols broadly moved away from book-value-of-vault oracles for permissionlessly-listed collateral, and the standing-surface contracted as the standard oracle-design pattern improved — though, as Mango Markets (2022) and subsequent incidents demonstrated, the T9.001 family is not retired, and the spot-price-of-thin-venue sub-pattern remains a live surface. Contributors writing other T9.001 examples should prefer cases where the oracle-architecture facts are documented in detail and where the failure mode is mechanically distinct from existing canonical cases, since the family is broad enough that taxonomic clarity depends on resolving the sub-patterns explicitly.

Techniques demonstrated (2)