Crema Finance hack — July 2022

Crema Finance, a concentrated-liquidity market maker on Solana, was drained of about $8.78 million on 2 July 2022 in an attack that ran for more than four hours.

Crema's pools record fee growth in per-price-range tick accounts. The Claim instruction did not check that the tick account handed to it actually belonged to the pool, so the attacker created their own account and filled it with fabricated data. They then took flash loans from the lending protocol Solend, deposited the borrowed capital as liquidity, and called DepositFixTokenType, Claim and WithdrawAllTokenTypes in a loop, each pass claiming fees calculated against the forged tick data. More than ten flash-loan transactions hit five pools: USDT-USDC, mSOL-wSOL, stSOL-wSOL, PAI-USDC and USDH-USDC. The proceeds came to 69,422.9 SOL and 6,497,738 USDC, and the USDC was bridged to Ethereum through Wormhole and swapped for about 6,064 ETH. Crema's total value locked fell from about $12 million to about $3 million.

Crema suspended its contracts, worked with outside researchers and negotiated directly with the attacker, having first given a 72-hour ultimatum that threatened police involvement. The attacker agreed to return the funds in exchange for 45,455 SOL, which The Record valued at roughly $1.68 million at the time and Halborn at about $1.4 million. On 6 July Crema said it had received 6,064 ETH and 23,967.9 SOL in four transactions, exactly the amount taken less the 45,455 SOL bounty, and The Record valued the returned funds at about $8.3 million. Crema described the attacker as a white hat; no charges have been reported. Users were compensated with 15,000,000 CRM, equivalent to 1.5 per cent of the token's hard cap.