The team behind DeFi money market C.R.E.A.M. Finance has come forward with a plan for partially compensating victims of the Oct. 27 exploit.
The Yearn-affiliated money market is draining its treasury to repay users. 1.45M CREAM governance tokens had been set aside for future team remuneration, but will now be distributed proportionally to uninsured victims of the hack.
Which raises the question: why would those building C.R.E.A.M. stick around without more tokens to look forward to?
Third Largest DeFi Hack
Approximately $130M in crypto assets were lost in late October in a flash loan attack; the team has now made $68M in CREAM tokens available to repay those who lost funds. The theft was the third largest exploit of a decentralized finance (DeFi) protocol. In a post-mortem, the team explained that it had been a combined oracle and flash loan attack.
The report said, “The key vulnerability lies in the price calculation of a wrappable token. We have stopped all supply/borrow of wrappable tokens.”
The attack impacted the Ethereum v1 markets on C.R.E.A.M. This followed a $23 million reentrancy attack against the AMP and ETH pools at the end of August.
On Nov. 13, the team published a blog post explaining how it would move forward, writing, “We will distribute 1,453,415 CREAM tokens to impacted users. We are utilizing the remaining CREAM tokens within the treasury, and removing the project team’s remaining CREAM token allocation. There will be no further CREAM allocations to the team.”
Victims will have a year to claim their payout.
C.R.E.A.M. was created as a fork of Compound, which recently suffered its own setback. Both protocols are money markets, where users can deposit one asset as collateral and withdraw another as a loan. C.R.E.A.M. is known for accepting so-called long-tail assets, which are a wider array of tokens than the leading money markets. In Nov. 2020, it joined the Yearn Finance ecosystem.
Team members behind the money market did not immediately reply to a request for comment from The Defiant.
Mike Ghen is a user of C.R.E.A.M. and the founder of Ricochet Exchange, an investing project built on Polygon. “I thought it was a generally nice thing to do. When there is a problem like this I think the team should pay,” Ghen said.
Ghen had been drawn to C.R.E.A.M. early on because it allowed him to borrow against tokens that other money markets wouldn’t accept. After the October breach, he had argued at the time that the project should simply dilute holders of the CREAM token by minting more, but it ended up following a different course, with the team taking the entire hit..
The price of the CREAM token has taken two giant drops since the exploit, first following the breach and second after the compensation plan was announced. It fell from $153.33 on October 27 to $100.4 the same day, according to CoinMarketCap. The price continued to slowly fall afterwards, reaching $87.14 on Nov. 13, before the announcement. Once the blog post came out, it immediately fell to $53.76.
As of the afternoon in New York on Nov. 15, CREAM is trading at $46.71. At current prices, $68M in assets are available to those who were uninsured going into the October 27 exploit.
While primarily known as a retail lender, it has also created the Iron Bank, a protocol-to-protocol lending platform. The Iron Bank was untouched by this exploit.
The chief concern for CREAM holders now might be how the project will continue to move forward if team members don’t have future distributions of CREAM tokens to look forward to.
Ghen is less concerned about this, because they should already have significant holdings and will be highly motivated to restore the value of their holdings, which are now worth less than a third of what they were last month.
“It’s not like the team has no stake. The team still has CREAM tokens,” Ghen said. But he also believes they have additional reasons to stick around.
Betting on Iron Bank
C.R.E.A.M. may have started out as a money market more willing to take risks than leaders like Compound and Aave, but it eventually started to innovate. In this weekend’s blog post, the team confirmed it would focus more now on its more unique offerings.
“We will continue our focus on growing the Iron Bank by expanding our protocol-to-protocol loan offering,” C.R.E.A.M’s post said, adding that it’s going to be much more judicious about the tokens it lists and explicitly discontinuing listing more complex tokens.
The Iron Bank, Ghen said, might be enough to make CREAM worth holding onto. “I think personally that it’s a completely novel thing. I think the team will stick around.”