This actually isn't quite correct. The original protocol actually had a formal spec that accompanied it. CreamFi chose to not maintain this spec. The spec const

This actually isn't quite correct. The original protocol actually had a formal spec that accompanied it. CreamFi chose to not maintain this spec. The spec constrained under what conditions the protocol could operate securely and (ignoring that their changes broke away from the spec) some of the tokens used in this and previous exploits to CreamFi did not meet those constraints. Had the team actually maintained the formal spec, they could have notified the listing committee (which every iteration of has had at least one team member on it). This was absolutely a human error however it likely would have been caught prior to entering production if the team had maintained the formal spec.