News on November 1, Cream Finance, a mortgage lending platform. A detailed report was issued on the October 27 lightning loan attack, stating that it was cooperating with the authorities to track down the attackers. The attack lost about 130 million U.S. dollars. A detailed repayment plan will be announced in the next few days.
Cream stated that the attack was a mixture of economic attacks and oracles attacks. The attackers lent DAI from MakerDAO to create a large amount of yUSD tokens.
At the same time, by manipulating the multi-asset liquidity pool, the price oracle is used to calculate the yUSD price. After the yUSD price rises, the attacker’s yUSD position increases, creating enough borrowing limits to offset the liquidity of the Cream Ethereum v1 market.
Cream said that all interactions in the Ethereum v1 market in Cream Finance have been suspended. The key vulnerability lies in the price calculation of packageable tokens. The supply/lending of all packaged tokens has been stopped, including all PancakeSwap LP tokens.