Cream platform hacked, $130 million stolen

On October 27, 2021, the CREAM lending platform was attacked and lost 130 million U.S. dollars of funds. With reference to the descriptions of the SlowMist audit team and other bigwigs, the situation of the attack can be roughly drawn

First of all, because CREAM is not connected to chainlink's quotation oracle, its own quotation system has made mistakes, so attackers can manipulate asset prices

The attacker printed 500M of YUSD through flash mint and deposited it into CREAM, and then used a flash loan to lend 500K of ether and deposited it into CREAM
Repeat stacking and depositing the YUSD just now back to the CREAM platform to destroy 500M of YUSD and exchange it for DAI
Transfer 9M to 4POOL, so CREAM's YUSD quotation is abnormal, so the 500KETH loan is returned one after another, and the agreement is borrowed through the IOU in hand.