The price is the attack surface
Every lending protocol must answer one question continuously: what is this collateral worth? If the answer comes from a source an attacker can move, the attacker sets their own borrowing limit.
Flash loans supply the capital to move a thin market for the duration of a single transaction. Nothing about the borrowing logic needs to be broken — it works correctly on a false input.
What separates a robust feed from a fragile one
Time-weighted averages raise the cost, because an attacker must hold the distortion across blocks rather than a moment. Multiple independent sources raise it further. Protocols reading an instantaneous spot price from one venue are the exposed case, and which oracle a protocol uses is public information in its contracts.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
- The attack is executed across Cream lending markets; Cream confirms the exploit. Cream Finance
What to check
Cream Finance published incident statements on its own channels.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Cream Finance, Incident statements (27 Oct 2021)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
