On July 2, 2022, Crema Finance's Solana protocol was exploited when an attacker bypassed owner verification on tick accounts used for fee calculations. The attacker created a fraudulent tick account, obtained a flashloan from Solend, added liquidity to the CLMM pool, and exploited the manipulated pricing to drain $8.78M (69,500 SOL + $6.5M stablecoins).

The centralized liquidity DeFi application Crema Finance on the Solana chain announced its shutdown due to a hacker attack. The official Twitter of the protocol quoted information from the on-chain browser SolanaFM, saying that the value of the lost encrypted assets was $8.782 million. Early this morning, Crema Finance disclosed the attacked thread, saying that hackers bypassed contract checks by creating a fake price change data account (Tickaccount), and then used fake price data and flash loans to steal huge fees from the fund pool. On July 7, Crema Finance said on Twitter that after a long negotiation, Crema Finance attackers agreed to collect 45,455 SOL (about $1.682 million) as a white hat bounty, and had returned 6,064 Ethereum and 23,967.9 SOL (approximately $8.1 million).