moonwell

The decentralized lending protocol Moonwell is investigating issues affecting the MAMO Core Market on Base. Security firms CertiK and PeckShield have flagged a multi-million dollar exploit incident, estimating losses of approximately $8.7 million.Moonwell stated on X that as a precaution, the borrowing limit for all Core Markets on Base has been set to 1 wei, and the supply limits for MAMO and WELL have also been set to 1 wei. PeckShield noted that the attacker aggregated stolen funds to an address for the DAI stablecoin; CertiK indicated that the attacker manipulated the collateral price of the low liquidity MAMO token and then borrowed real cbBTC from the mCBTC market to carry out the attack, with Blockaid also identifying the same attack mechanism.As a result, the WELL token dropped about 13% in 24 hours, while MAMO fell about 9%. This exploit incident is part of a period of frequent DeFi vulnerabilities since April, during which multiple protocols have been hacked for over $600 million, with the largest being a $292 million exploit of Kelp DAO.

According to monitoring by Blockaid, its vulnerability detection system has found suspicious activity on the Base chain related to Moonwell. Attackers manipulated the MAMO collateral price to borrow cbBTC from the mCBTC market.The currently observed impact is the transfer of 50.6 cbBTC (worth over 4 million USD).

According to The Block, the DeFi lending protocol Moonwell is facing a governance attack on its deployment on Moonriver. An unknown attacker spent approximately $1,800 to purchase about 40 million MFAM tokens, completing the purchase, initiating a proposal, and voting for approval within about 11 minutes. The attacker attempted to transfer the administrator rights of core contracts such as seven lending markets, controllers, and oracles to their controlling contract, which would allow them to withdraw approximately $1.08 million in user funds.Currently, the voting on the proposal will continue until March 27. It has already reached the quorum early on, but the opposing votes are currently in the majority. However, the final result still depends on the remaining votes and collaboration. Moonwell can also veto the proposal and regain control through the emergency multi-signature "Break Glass Guardian."

Due to an oracle configuration error resulting in approximately $1.78 million in bad debt, the DeFi lending protocol Moonwell released an event handling update on the X platform, stating that the recovery plan has now been published on the governance forum, which includes integrating the Moonwell Apollo (MFAM) community into the Moonwell ecosystem (WELL).The Moonwell Apollo Treasury will immediately initiate partial compensation, with ongoing compensation to follow through protocol revenue. Additionally, MFAM holders and stkWELL stakers are set to receive compensation at a ratio of 1:1.5 (MFAM:stkWELL).

The DeFi lending protocol Moonwell released an official statement following approximately $1.78 million in bad debt caused by an oracle configuration error. The statement confirmed that a serious error in one oracle configuration led to the system not calculating the cbETH price as expected through cbETH/ETH × ETH/USD, but instead only using the cbETH/ETH exchange rate. This resulted in the cbETH price being approximately $1.12 instead of the actual market price of about $2200. The attacker only needed to repay about $1 in debt to liquidate 1 cbETH, causing a large number of borrowers' collateral assets to be liquidated and resulting in significant bad debt. In total, 1096.317 cbETH was liquidated, most of which was bad debt valued in cbETH.As the oracle fix requires a five-day governance voting and time-lock process, liquidations are still ongoing during this period. A related governance proposal for the fix is planned to be launched.

According to Decrypt, the DeFi lending protocol Moonwell has incurred approximately $1.78 million in bad debt due to an oracle configuration error.After enabling Chainlink's OEV wrapper contract through governance proposal MIP-X43, there was a severe misconfiguration of the price oracle for cbETH, which was once valued at only $1. On-chain trading bots and liquidators acted quickly, seizing cbETH collateral worth thousands of dollars by repaying a debt of about $1.This configuration error led to the liquidation of 1,096.317 cbETH, wiping out most or all of the collateral for many borrowers, leaving the protocol with a significant amount of bad debt. The Moonwell team immediately reduced the cbETH borrowing limit and supply cap to 0.01 upon discovery to limit further losses, but a spokesperson declined to comment further on the source of the error or the details of the vulnerability.

According to CertiK monitoring, the Moonwell lending contract has been subjected to multiple attack transactions.The attacker exploited the incorrect price returned by the oracle (approximately $5.8 million), by borrowing about 0.02 wrstETH through a flash loan and depositing it, repeatedly borrowing over 20 wstETH, profiting 295 ETH (approximately $1 million).

ChainCatcher news, according to Cyvers Alerts monitoring, the USDC lending contract of Moonwell on the Optimism network has suffered a flash loan attack. The attacker used a malicious contract address as mToken to obtain unauthorized token approvals from Moonhackers, thereby stealing funds. The attacker received funding support through Tornado Cash on the Ethereum network, and the stolen USDC has been exchanged for DAI, which is currently stored in the attacker's wallet.

ChainCatcher news, according to the official announcement, Coinbase will add support for Moonwell (WELL) on the Base network (ERC-20 tokens). If liquidity conditions are met, trading will begin on September 24, 2024, at or after 9 AM Pacific Time.

ChainCatcher message, Coinbase Assets announced on platform X that Moonwell (WELL) on the Base network will be added to the coin listing roadmap.