A Reentrant Borrow Call Drains $18.8M from Cream's AMP Market

Cream Finance lost approximately $18.8 million on Monday, August 30, 2021, after an attacker found a reentrancy path through a token the protocol had listed months earlier. The lending platform had passed an audit from Trail of Bits on January 28, 2021 — one of the few audit firms not represented on rekt's leaderboard — but that review predated a governance change that reopened the door to risk.

On February 10, 2021, a Cream governance proposal took effect, listing the AMP token as collateral. That listing is what PeckShield later identified as the source of the vulnerability exploited months later.

How the reentrancy worked

AMP's token contract layers ERC777-style transfer hooks on top of the ERC1820 registry, exposing a pre-transfer callback. Because that callback fires mid-transfer, the AMP contract let an attacker call Cream's borrow() function a second time before the first borrow() call had finished updating state — a classic reentrancy window.

The attacker exploited this using two contracts and a receiving wallet: Contract A, Contract B, and an exploiter wallet. One sample transaction, representative of 17 total, ran as follows:

1. Contract A took a 500 WETH flash loan and posted it as Cream collateral, minting 24.17k crETH.
2. It then borrowed 19.48 million AMP against that crETH position.
3. During the AMP transfer, the reentrancy bug let the contract call borrow() a second time, extracting an additional 355 ETH before the first borrow call's state update had completed.
4. Contract B was deployed and funded with half of the borrowed AMP — 9.74 million tokens.
5. Contract B used that AMP to partially liquidate Contract A's loan, recovering 187 WETH and sending it back to Contract A.
6. Contract A used the ETH obtained through the reentrant borrow to repay the remainder of its flash loan, walking away with a net profit of 41 ETH and 9.74 million AMP from that single transaction.

Repeating this pattern across 17 transactions netted the attacker close to 6,000 ETH in total, worth just over $18 million at the time. As of the report, the proceeds remained sitting in the exploiter's address.

Context

This marked Cream's first exploit as a direct target, despite an already shaky reputation stemming from its earlier involvement in the Alpha Finance incident. It underscored a recurring lesson: even an audited, established protocol can be undermined the moment it integrates a token whose non-standard transfer behavior opens a new attack surface. Security researcher @muditgupta noted that the entire episode could plausibly have been prevented had Cream simply applied reentrancy guards to its borrow and lend functions.