Solana-Powered Crema Finance Loses Almost USD 9M in Flash Loan Attack
Crema Finance, a concentrated liquidity protocol built on the Solana (SOL) blockchain, has lost over USD 8.7m worth of crypto assets in a flash loan attack that drained its liquidity reserves.
The protocol's official Twitter account confirmed the hack on Sunday and announced the temporary suspension of the service as they started an investigation.
"Our protocol seems to have just experienced a hacking," Crema Finance's Twitter account said. "We temporarily suspended the program and are investigating it. Updates will be shared here ASAP."
In an update, the team explained that the hacker started by creating a fake tick account, which is a dedicated account that stores price tick data in a concentrated liquidity market maker (CLMM). Subsequently, they were able to sidestep the routine "check" process by "writing the initialized tick address of the pool into the fake account."
The hacker then deployed a contract that allowed them to lend a flash loan from borrowing and lending service Solend and add liquidity on Crema to open positions.
"In CLMM, the calculation of transaction fees mainly relies on the data in tick account. As a result, the authentic transaction fee data was replaced by the faked data so the hacker completed the stealing by claiming a huge fee amount out from the pool," Crema Finance said.
According to an investigation by Solana explorer SolanaFM, Crema Finance was exploited to the tune of USD 8.78m, which included various amounts of USDT, USDH Hubble Stablecoin, as well as crypto synths.
Meanwhile, the project shared the addresses linked to the hacker, claiming that they would be tracking the movement of stolen funds.
"More and more relevant organizations are providing valuable clues for us. Also, we're still
Read more on cryptonews.com
