CREAM FINANCE

DESCRIPTION OF EVENTS

"C.R.E.A.M. Finance is a decentralized lending protocol for individuals, institutions and protocols to access financial services. Part of the yearn finance ecosystem, it is a permissionless, open source and blockchain agnostic protocol serving users on Ethereum, Binance Smart Chain and Fantom. Users who are passively holding Ethereum or Bitcoin can deposit their assets on C.R.E.A.M. to earn yield, similar to a traditional savings account."

"On March 15, C.R.E.A.M. Finance encountered DNS hijacking. Our GoDaddy account was compromised, redirecting users to a phishing page." "GoDaddy DNS CNAME record not pointing to our hosting IP, consistent with the website outage." "[O]ur GoDaddy login credentials were compromised." "The first unusual behavior in GoDaddy activity log is a password reset request sent to attacker’s email address, but there is no record of email address change."

"Earlier today, a similar service called Cream Finance said its DNS (domain name service) had been "compromised by a third party." PancakeSwap’s Twitter account then confirmed that it had been attacked through the same mechanism."

"To our community ~ http://cream.finance and http://app.cream.finance are now considered compromised sites - DO NOT USE either domain until further notice."

"The hijacker appears to be asking users to input the 12-word seed phrase unique to each crypto wallet in order to steal funds."

"[W]e want to thank the community for all of their support while we worked to fix the DNS hijacking issue. W[e w]ant to assure you all that all funds are safe, and we have regained control over our DNS!"

Cream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase.

It is not known how many users decided to enter their seed phrase and were affected.

HOW COULD THIS HAVE BEEN PREVENTED?

In general, most users are educated against entering their seed phrase on any website, DNS hijacking incidents are relatively rare, and only a small portion of platform users would interact with the platform site while the event happens.

This type of situation is likely best dealt with through education for users, better training for platform operators regarding the proper domain name security, and having a fund set up to assist users in case of loss events.

Check Our Framework For Safe Secure Exchange Platforms

DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt (Jun 26)
@CreamdotFinance Twitter (Jun 26)
C.R.E.A.M. (Jun 26)
@CreamdotFinance Twitter (Jun 26)
@cz_binance Twitter (Jun 26)
DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk (Jun 26)
@CreamdotFinance Twitter (Jun 26)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
Postmortem Report Of Dns Hijacking (Aug 11)
Cream Finance launches $1.5M bug bounty to improve DeFi security (Feb 8)
Cream Finance Review: What You NEED To Know About CREAM!! (Feb 8)

More case studies

CyberFi Phishing
Attack BetItAllJonny

Iron Finance
Burned