Crema Finance, a concentrated liquidity protocol built on the Solana (SOL) blockchain, has lost over USD 8.7m worth of crypto assets in a flash loan attack that drained its liquidity reserves.
The protocol’s official Twitter account confirmed the hack on Sunday and announced the temporary suspension of the service as they started an investigation.
“Our protocol seems to have just experienced a hacking,” Crema Finance’s Twitter account
🚨🚨Attention! Our protocol seems to have just experienced a hacking. We temporarily suspended the program and are investigating it. Updates will be shared here ASAP.
— CremaFinance (@Crema_Finance) July 3, 2022
said. “We temporarily suspended the program and are investigating it. Updates will be shared here ASAP.”
In an update, the team
4) After creating the fake tick account, the hacker circumvented our routined owner check on the tick account by writing the initialized tick address of the pool into the fake account. Txid: https://t.co/X0IneBg9ut
— CremaFinance (@Crema_Finance) July 3, 2022
explained that the hacker started by creating a fake tick account, which is a dedicated account that stores price tick data in a concentrated liquidity market maker (CLMM). Subsequently, they were able to sidestep the routine “check” process by “writing the initialized tick address of the pool into the fake account.”
The hacker then deployed a contract that allowed them to lend a flash loan from borrowing and lending service Solend and add liquidity on Crema to open positions.
“In CLMM, the calculation of transaction fees mainly relies on the data in tick account. As a result, the authentic transaction fee data was replaced by the faked data so the hacker completed the stealing by claiming a huge fee amount out from the pool,” Crema Finance said.
According to an investigation by Solana explorer SolanaFM, Crema Finance was exploited to the tune of USD 8.78m, which included various amounts of USDT, USDH Hubble Stablecoin, as well as crypto synths.
1b/: Solend Flash Loans
10,500 $mSOL (Solend Main Pool Vault): https://t.co/5jFZcqcv94
57,000 $stSOL (Solend Main Pool Vault): https://t.co/8UjlmR0PWE
840,000 $PAI (Solend Stable Pool Vault): https://t.co/7QORKPLCLm pic.twitter.com/eyo2u42naM
— SolanaFM: EXPLORER UP! 🔮🔍 (@solanafm) July 3, 2022
Meanwhile, the project shared the addresses linked to the hacker, claiming that they would be tracking the movement of stolen funds.
“More and more relevant organizations are providing valuable clues for us. Also, we’re still open to a communication with the hacker before the time window is closed,” the project
10) Now the fund is located and we'll keep tracking its movements. More and more relevant orginazations are providing valuable clues for us. Also, we're still open to a communication with the hacker before the time window is closed.
— CremaFinance (@Crema_Finance) July 3, 2022
said.
Source: Cryptonews
