Partnered With:

Learn more about cream. Finance's ERC777 reentrant attack

Read this article in 4 Minutes

On August 30, Pie Shield sent out a warning, Cream Finance was attacked by lightning loan, attackers took advantage of the vulnerability to make a total profit of 5890ETH (about 18.8 million US dollars).

Cream.Finance's ERC777 reentrant attack

原文作者： PeckShield

On 30 August, Cream.Finance was hit by a reentrant attack, and PeckShield's "dispatch Shield" was first alerted and located.

Since AMP supports token standards similar to ERC-777, and its features are incompatible with certain protocols, this cream. Finance reentrant attack manipulated this vulnerability.

PeckShield's "Dispatch Shield" briefly describes one of 17 attacks that the attacker made:

首先，攻击者创建攻击合约 A，从 UniSwap V2 中借出闪电贷 500 WETH；

第二步，攻击者将所借 500 WETH 质押到到 Cream.Finance，获得 24,172.2 crETH；

In step 3, attack contract A borrows 19.48 million AMP using the pledge obtained in step 2 via function cerc20Delegator.borrow (). At the same time, using the reentrant vulnerability, before the user's information is updated, crETH token is lent to obtain 355 ETH.

In the fourth step, the attacker creates attack contract B and transfers 9.74 million AMP tokens from attack contract A to attack contract B. Attack contract A is insolvent because of the reentrant attack in step 3. So the attacker uses 9.74 million AMP of attack contract B to clear attack contract A and get 9,068.6 crETH.

第五步，攻击合约 B 赎回 9,068.6 crETH，获得 187.58 ETH；此时，合约 B 的 balanceof() 为 187.58 WETH；

第六步，合约 B 将 187.58 WETH 转给合约 A，并调用函数 selfdestruct()；合约 A 的余额为 542.58 ETH；

In the end, the attackers returned the flash loan, making $18.8 million.

defense

During token exchange, the user's token is deducted and ETH is sent to the user.

When interacting with multiple contracts, it is necessary to consider the possible systemic risk of DeFi business portfolio. The platform should not only ensure a good code audit and vulnerability screening before launching products, but also consider the potential systemic risk control problems caused by different business logic when making business portfolio of different products.