C.R.E.A.M. Finance (Iron Bank)

Summary

C.R.E.A.M. Finance launched on Ethereum on August 3, 2020 as a fork of Compound, run initially by Taiwanese entrepreneur Jeffrey Huang, and expanded to BNB Chain the following month. Its distinguishing contribution was not the lending pool itself but the Iron Bank, introduced with CREAM v2: a facility that lent to other protocols with no collateral at all, substituting a whitelist and a governance-set credit limit for the overcollateralization every other onchain money market required. That let borrowers such as Alpha Homora and Yearn treat CREAM as a liquidity backstop rather than a place to park excess assets, and it produced the first DAO-to-DAO loan of its kind. It also concentrated a great deal of risk in two judgements — who is creditworthy, and what is the collateral worth — and both were tested repeatedly. CREAM was exploited three times in 2021, in February, August, and October, the last of which drained roughly $130 million and stands among the largest DeFi losses of that year.

Design (Mechanism)

The base protocol was a Compound fork: suppliers deposit an asset and receive an interest-bearing crToken, borrowers post collateral and may draw up to a collateral factor, and positions falling below that factor are liquidated. CREAM's variation was to list assets that more conservative markets would not, which drew supply but widened the surface on which collateral had to be priced correctly.

The Iron Bank changed the borrower rather than the loan. A protocol approved by CREAM governance was whitelisted and assigned a credit limit; within that limit it could borrow directly from CREAM's pools with no collateral posted. The premise is that a contract is a more legible borrower than a person — its behaviour is public, its solvency is inspectable, and it cannot abscond — so creditworthiness can be assessed once and encoded as a number rather than demanded continuously as collateral. Capital efficiency followed: Alpha Homora used Iron Bank credit to offer leveraged yield farming at levels an overcollateralized design cannot reach, because the leverage no longer had to be funded by locked assets.

Collateral pricing was the load-bearing assumption underneath both halves. CREAM valued yield-bearing collateral by reading a vault's exchange rate — for yUSD, the ratio of Curve LP tokens the vault controlled to the yUSD in circulation. That rate is a live quantity derived from a balance anyone may change.

Outcome

The Iron Bank worked as designed and was used: it supplied credit to Alpha Homora and Yearn strategies and executed the first DAO-to-DAO loan of its type with PleasrDAO. The pricing assumption did not hold.

In February 2021 an exploit of Alpha Finance's Alpha Homora v2 used CREAM's Iron Bank as its venue, and roughly $37.5 million was lost. The root cause sat in the borrowing protocol rather than in CREAM, but the loss landed on CREAM's pools — which is the structural point of uncollateralized credit.

In August 2021 an attacker took a 500 ETH flash loan and exploited a reentrancy path opened by CREAM's integration of the AMP token. AMP implements ERC-777, whose transfer hooks hand control back to the caller mid-transfer; the integration did not account for that re-entry, and roughly $18.8–19 million was taken, with some contemporaneous reports citing figures above $25 million.

On October 27, 2021 the collateral oracle itself was the target. Using a $500 million DAI flash mint from MakerDAO and roughly $2 billion of ETH flash-borrowed from Aave v2, the attacker transferred about $10 million of Curve LP tokens directly into the yUSD vault. Because a direct transfer raises the vault's assets without recording any corresponding liability, the exchange rate — and therefore CREAM's valuation of yUSD collateral — roughly doubled, marking collateral worth $1 at $2. Recursive borrowing against the inflated position produced paper collateral reported in the billions, against which the attacker drained approximately $130 million of real liquidity. CREAM subsequently suspended its Ethereum v1 markets and locked the affected crTokens.

Why it worked

• Replacing collateral with a credit limit is a genuine efficiency gain, not merely a looser rule: a whitelisted contract's solvency is publicly inspectable and it cannot flee, so continuous overcollateralization is arguably redundant risk control for that specific borrower class.
• Moving leverage off the borrower's balance sheet let integrating protocols offer strategies that overcollateralized credit cannot fund, which is why Alpha Homora and Yearn integrated rather than simply supplying elsewhere.
• Listing assets that more conservative markets declined attracted supply and borrowers who had nowhere else to go, which built usage quickly.

Where the design broke

• Valuing collateral from a vault share price that any address can move by transferring assets in makes the oracle a public write surface. A direct transfer increased assets without recording a liability, so the rate could be doubled by anyone willing to fund the transfer for one transaction — and flash loans made that funding free.
• Uncollateralized protocol-to-protocol credit inherits every borrower's bugs. In February the flaw was in Alpha Homora, but the credit line meant CREAM's suppliers carried the loss: the credit limit bounded the exposure, not the correctness of the borrower.
• Listing long-tail assets multiplies the number of pricing and token-behaviour assumptions that must each hold. ERC-777's transfer hooks are documented behaviour, not an exotic bug, and a Compound fork written against ERC-20 semantics had no reason to expect re-entry mid-transfer.
• Three exploits in a single year against the same protocol suggests the pattern was structural rather than incidental: each new listing and each new integration added assumptions faster than they could be individually verified.

Lessons

• Never derive collateral value from a quantity an unprivileged address can change in one transaction. A vault exchange rate computed as assets over shares is manipulable precisely when assets can be added without a matching liability.
• Uncollateralized credit transfers a borrower's risk to the lender's suppliers. A credit limit caps how much can be lost per borrower; it does nothing to make the borrower correct, so whitelisting is an ongoing security review rather than a one-time governance vote.
• Token standards are part of a protocol's threat model. Integrating an ERC-777 asset into a codebase written against ERC-20 introduces reentrancy that no amount of review of the lending logic alone will surface.
• The cost of listing an asset is not the listing but the permanent obligation to price it correctly under adversarial conditions, for as long as it remains listed.

Redesign (EDITORIAL)

EDITORIAL — hypothesis, not fact. A version of this design more resistant to the failures it actually met might (1) price yield-bearing collateral from a supply-and-liability accounting that ignores unsolicited transfers, or from a time-weighted rate that a single transaction cannot move; (2) cap the rate of change of any collateral valuation per block, so that a doubling is rejected as implausible rather than acted upon; (3) treat each Iron Bank credit line as an ongoing underwriting position with a required re-review on any borrower upgrade, rather than a limit set once at whitelist time; (4) route every new asset listing through a standards check that flags transfer-hook tokens for a reentrancy-specific review before the market opens; and (5) size credit limits against a supplier-funded backstop, so that the pool bearing a borrower's failure is capitalised for it in advance.