C.R.E.A.M. Finance (CREAM): how it works, supply and reviews
In short
- Type
- Permissionless, non-custodial lending protocol (money markets)
- Risks and caveats
- The protocol was exploited twice in 2021 (August, AMP market; October, about $130 million from Ethereum v1 markets).
- Checked
- 31 October 2026
Visitor ratings: do you like C.R.E.A.M. Finance?
Key facts
- Ticker
- CREAM
- Official site
- app.cream.finance
Key facts checked on 31 October 2026 against official sources.
What is C.R.E.A.M. Finance
C.R.E.A.M. Finance is a decentralized lending protocol: users supply crypto assets to earn interest and borrow other assets against them. Its app says it is part of the Yearn Finance ecosystem and serves users on several EVM chains.
Network and consensus
| Parameter | Details |
|---|---|
| Type | Permissionless, non-custodial lending protocol (money markets) |
| Runs on | Ethereum, Arbitrum One, Base, BNB Chain and Polygon, according to the app home page |
| How lending works | Users lend supported assets and use them as collateral to borrow another supported asset. |
| Price oracle | Chainlink is the main price oracle. |
| Current markets | The app lists a CRV Pool, a CREAM Pool and a Meme Pool, with CRV, crvUSD, USDT, USDC, FRAX, DAI and WETH markets. |
What CREAM is used for
- CREAM can be locked for 1 week to 4 years to receive iceCREAM, which is non-transferable.
- iceCREAM is used for voting, staking and boosting; 1 iceCREAM = 1 governance vote.
- 50% or more of protocol reserves are to be distributed to iceCREAM stakers as ycrvIB tokens.
- The more iceCREAM staked, the more CREAM rewards a user earns (boost from 0.4 up to 2.5x).
Who develops and governs C.R.E.A.M. Finance
- Legal entity
- The website interface is made available by Asia Authority International CO., Ltd., a Samoa company.
- Steward
- Jeffrey Huang is listed as steward.
- Governance
- iceCREAM holders vote; 1 iceCREAM = 1 vote. Long-term CREAM stakers can also vote.
- Ecosystem
- Part of the Yearn Finance ecosystem, according to the app.
- Open source
- Open-source code on GitHub (CreamFi).
History
| Date | Event |
|---|---|
| August 2020 | C.R.E.A.M. Finance launched its lending platform; a blog post of 4 August 2020 thanked users for their support since the launch the day before. |
| January 2021 | C.R.E.A.M. launched the Iron Bank, which it describes as a protocol-to-protocol lending platform. |
| 28 January 2021 | Trail of Bits completed a security assessment of C.R.E.A.M. |
| 29 June 2021 | C.R.E.A.M. announced money markets on Polygon. |
| 31 August 2021 | The protocol was exploited for 462,079,976 AMP and 2,804.96 ETH through a reentrancy flaw in its AMP market integration. |
| 27 October 2021 | A flash-loan and oracle exploit removed about $130 million of tokens from the Ethereum v1 markets. |
| 27 January 2022 | Snapshot for the distribution of IB (Iron Bank) tokens to CREAM stakers. |
Security and audits
- Trail of Bits reviewed C.R.E.A.M. (report dated 28 January 2021), looking for price-oracle manipulation, cap bypasses and access-control flaws.
- After the August 2021 exploit C.R.E.A.M. paused AMP supply and borrowing and offered the exploiter a 10% bug bounty for returning funds.
- After the October 2021 exploit the Ethereum v1 markets were suspended and supply/borrow of wrappable tokens was stopped.
Security incidents
| Date | What happened | Source |
|---|---|---|
| 24 February 2021 | Counterparty exposure: Joint C.R.E.A.M./Alpha statement on repaying extra debt that a recent attack on Alpha Homora V2 created towards C.R.E.A.M. V2 (Iron Bank): 13,245 ETH, 4,263,139 DAI, 4,032,014 USDC and 5,647,242 USDT plus interest. Attack date not given in the statement. Funds returned: Alpha Homora V2 committed 20% of its reserves monthly until the debt is repaid; each side used 1,000 ETH the attacker sent to its deployer. | medium.com |
| 31 August 2021 | Exploit: Reentrancy exploit through the AMP market integration (ERC-777 transfer hooks), about 12:00 UTC+8: 462,079,976 AMP and 2,804.96 ETH taken, plus a smaller copy-cat exploit. C.R.E.A.M. says the root cause was its own integration error, not AMP's code. Funds returned: C.R.E.A.M. said it would replace the stolen ETH and AMP and allocate 20% of protocol fees to repayment. | medium.com |
| 27 October 2021 | Exploit: Flash-loan and price-oracle exploit of the yUSD price calculation removed about $130 million of tokens from the Ethereum v1 markets; other v1 markets and the Iron Bank were not affected. Funds returned: Yearn salvaged $9.42 million for return to the C.R.E.A.M. multisig; a repayment plan was announced as to follow. | medium.com |
Further incidents are reported by third parties (press, incident databases) but are not confirmed in the company’s own channels, so they are not listed here.
Official CREAM contracts
| Network | Contract address |
|---|---|
| Ethereum | 0x2ba592F78dB6436527729929AAf6c908497cB200 |
CREAM token contract on Ethereum as listed in the C.R.E.A.M. docs.
Risks and caveats
- The protocol was exploited twice in 2021 (August, AMP market; October, about $130 million from Ethereum v1 markets).
- The terms say the smart contracts are not offered to US persons or residents of listed restricted territories, including Canada and Taiwan.
- Use is at the user's own risk: blockchain transactions are irreversible and the company accepts no responsibility for resulting losses.
- Prices rely on oracles (mainly Chainlink); the October 2021 exploit manipulated a price calculation.
Official links
- Website: app.cream.finance
- Docs: docs.cream.finance
- Source code: github.com/CreamFi
- Governance forum: vote.cream.finance
- Blog: medium.com/cream-finance
Questions and answers
What is Cream Finance?
C.R.E.A.M. Finance is a permissionless, non-custodial lending protocol where users lend crypto assets and borrow against them. Its app says it is part of the Yearn Finance ecosystem.
Who runs Cream Finance?
The web interface is made available by Asia Authority International CO., Ltd., a Samoa company; the docs list Jeffrey Huang as steward.
Was Cream Finance hacked?
Yes. C.R.E.A.M. published post-mortems for an AMP-market exploit on 31 August 2021 (462,079,976 AMP and 2,804.96 ETH) and a flash-loan oracle exploit on 27 October 2021 (about $130 million).
What is iceCREAM?
iceCREAM is a non-transferable token received by locking CREAM for 1 week to 4 years; it gives governance votes and boosts CREAM rewards.
Can US users use Cream Finance?
No. The terms say the smart contracts and other services are not offered to US persons or residents of restricted territories.
Sources
- C.R.E.A.M. Finance — app home page
- C.R.E.A.M. Finance — docs overview
- C.R.E.A.M. Finance — Terms of Service
- C.R.E.A.M. Finance — iceCREAM tokenomics
- C.R.E.A.M. Finance — audit report
- C.R.E.A.M. Finance — contract address
- C.R.E.A.M. Finance — Post Mortem: AMP Exploit
- C.R.E.A.M. Finance — Post Mortem: Flash Loan Exploit Oct 27
- C.R.E.A.M. Finance — joint statement on repayment (Chinese, Wayback 24 February 2021)
- C.R.E.A.M. Finance — Medium home (Wayback 7 August 2020)
More in this section
- AirSwap (AST)
- BitcoinZ (BTCZ)
- Raiden Network (RDN)
- DeFiChain (DFI)
- Travala (AVA)
- UNUS SED LEO (LEO)
- All Crypto projects →
How voting works
Votes are anonymous and carry no text. Each device has one vote per item; press the same button again to remove it. Cloudflare Turnstile checks that a person is voting. We keep a random device ID in a cookie and a salted hash of the IP address to limit abuse — no names, no accounts. Votes are visitors’ opinions, not investment advice.
Page updated: