CREAM V1 economic exploit (27/10/2021)

Claim Event #4: CREAM V1 economic exploit (27/10/2021)

There is a full post-mortem of this loss event and the claim payouts in the Paying claims for the CREAM V1 exploit Medium post. Details of this event are also included below.

Total Claim Payouts

A total of 71.43 ETH and 90,000 DAI ($387,355.23) was paid out to Cover Holders including the Claim 102 payout from the Community Fund.


After this exploit occurred, Claims Assessors discussed this loss event in the mutual's Discord server. Because Nexus Mutual is a discretionary mutual, members participate in the Claims Assessment process and review the validity of claims submitted after a loss event occurs.
Members reviewed the information available in the days after the exploit, while CREAM V1 Protocol Cover holders waited for the 3-day cool-down period to pass before submitted claims. Claims Assessors discussed the event and determined the CREAM V1 economic exploit was covered under sections 1.2 and 1.3 of the Protocol Cover wording.
Source: Protocol Cover wording.
Once the 3-day cool-down period had passed, the mutual released a statement with instructions on How to File a Claim, as well as information about the active cover policies and the Claims Assessment process. Within this Medium article, there is a Google Sheet that contains CREAM V1 active cover policies where information has been included about accepted, denied, and unfiled claims.

Filed Claims and Outcomes

To date, eight (8) claims have been filed and voted on by Claims Assessors. As stated in the section above, Claims Assessors had determined this was a covered event. Once it has been determined that an event is covered, Claims Assessors review the validity of claims to determine:
  • Did the Cover Holder have acitve cover at the time of the exploit?
  • Did the Cover Holder provide Proof of Loss?
  • Did the Cover Holder lose 20% or more of the covered amount?

Approved Claims

Claims Assessors reviewed and approved Claims 98, 99, 100, 101, 103, and 105. These claims included proof of loss, which showed each affected Cover Holder suffered a loss of 20% or greater. You can review the transactions related to each claim in the Google Sheet and the Nexus Mutual user interface in the Claims section.
Claim 98
Claim 99
Claim 100
Claim 101
Claim 103
Claim 105

Denied Claims

Claims Assessors reviewed and denied Claims 102 and 104.
The Cover Holder who filed Claim 102 did hold active cover and this member was affected by the CREAM V1 economic exploit; however, they did not lose 20% or more. At the time of this loss event, Nexus Mutual was unable to pay partial claims. This is the reason for the 20% or greater clause in the Protocol Cover wording.
Claims Assessors can use their discretion when deciding claims. In this case, members recognised that a loss had occurred and this member should receive a payout. This could not be done through the Claims Assessment process, so members voted on a Snapshot proposal, which proposed paying out Claim 102 for the loss amount. This vote passed and the Cover Holder who filed Claim 102 was compensated using holdings from the Community Fund for their loss amount.
The Cover Holder who filed Claim 104 purchased Protocol Cover after the exploit took place and was not eligible for a claim payout for that reason.

CREAM Compensation Plan

On 13 November, Cream Finance announced that they would distribute 1,453,415 CREAM tokens to users affected by the exploit. In this announcement, the team also stated that “Users who have successfully made full insurance claims from Nexus Mutual or Bridge Mutual will not be eligible to claim CREAM.”
Members who filed a claim that was paid out have agreed to give any future rights to reimbursement from the Cream Finance team over to the mutual. The CREAM tokens will be claimed by the Community Fund and distributed proportionally to Risk Assessors who had NXM burned to facilitate the claim payouts.