moonwell

Сообщение ChainCatcher, децентрализованный кредитный протокол Moonwell проводит расследование проблемы, влияющей на рынок MAMO Core Market на платформе Base. Безопасностные компании CertiK и PeckShield отметили инцидент с уязвимостью на миллионы долларов, предполагаемые потери составляют около 8,7 миллиона долларов.Moonwell на X заявил, что в качестве меры предосторожности все кредитные лимиты на рынке Core Market на платформе Base установлены на уровне 1 wei, а лимиты поставок MAMO и WELL также установлены на уровне 1 wei. PeckShield утверждает, что злоумышленник собирал украденные средства на одном адресе DAI стабильной монеты; CertiK сообщает, что злоумышленник манипулировал ценами залога токенов MAMO с низкой ликвидностью, а затем занимал реальные cbBTC на рынке mCBTC для осуществления атаки, Blockaid также идентифицировал ту же механизму атаки.В результате WELL токен упал примерно на 13% за 24 часа, MAMO упал примерно на 9%. Этот инцидент с уязвимостью является частью периода частых уязвимостей DeFi с апреля, в течение которого несколько протоколов были украдены на сумму более 600 миллионов долларов, из которых наибольшая сумма составила 292 миллиона долларов уязвимости Kelp DAO.

Сообщение от ChainCatcher, согласно мониторингу Blockaid, их система обнаружения уязвимостей выявила подозрительную активность на цепочке Base в Moonwell. Злоумышленники манипулировали ценами залога MAMO, чтобы занять cbBTC на рынке mCBTC.В настоящее время зафиксировано влияние в 50.6 cbBTC (стоимостью более 4 миллионов долларов), которые были переведены.

According to The Block, the DeFi lending protocol Moonwell is facing a governance attack on its deployment on Moonriver. An unknown attacker spent approximately $1,800 to purchase about 40 million MFAM tokens, completing the purchase, initiating a proposal, and voting for approval within about 11 minutes. The attacker attempted to transfer the administrator rights of core contracts such as seven lending markets, controllers, and oracles to their controlling contract, which would allow them to withdraw approximately $1.08 million in user funds.Currently, the voting on the proposal will continue until March 27. It has already reached the quorum early on, but the opposing votes are currently in the majority. However, the final result still depends on the remaining votes and collaboration. Moonwell can also veto the proposal and regain control through the emergency multi-signature "Break Glass Guardian."

Due to an oracle configuration error resulting in approximately $1.78 million in bad debt, the DeFi lending protocol Moonwell released an event handling update on the X platform, stating that the recovery plan has now been published on the governance forum, which includes integrating the Moonwell Apollo (MFAM) community into the Moonwell ecosystem (WELL).The Moonwell Apollo Treasury will immediately initiate partial compensation, with ongoing compensation to follow through protocol revenue. Additionally, MFAM holders and stkWELL stakers are set to receive compensation at a ratio of 1:1.5 (MFAM:stkWELL).

The DeFi lending protocol Moonwell released an official statement following approximately $1.78 million in bad debt caused by an oracle configuration error. The statement confirmed that a serious error in one oracle configuration led to the system not calculating the cbETH price as expected through cbETH/ETH × ETH/USD, but instead only using the cbETH/ETH exchange rate. This resulted in the cbETH price being approximately $1.12 instead of the actual market price of about $2200. The attacker only needed to repay about $1 in debt to liquidate 1 cbETH, causing a large number of borrowers' collateral assets to be liquidated and resulting in significant bad debt. In total, 1096.317 cbETH was liquidated, most of which was bad debt valued in cbETH.As the oracle fix requires a five-day governance voting and time-lock process, liquidations are still ongoing during this period. A related governance proposal for the fix is planned to be launched.

According to Decrypt, the DeFi lending protocol Moonwell has incurred approximately $1.78 million in bad debt due to an oracle configuration error.After enabling Chainlink's OEV wrapper contract through governance proposal MIP-X43, there was a severe misconfiguration of the price oracle for cbETH, which was once valued at only $1. On-chain trading bots and liquidators acted quickly, seizing cbETH collateral worth thousands of dollars by repaying a debt of about $1.This configuration error led to the liquidation of 1,096.317 cbETH, wiping out most or all of the collateral for many borrowers, leaving the protocol with a significant amount of bad debt. The Moonwell team immediately reduced the cbETH borrowing limit and supply cap to 0.01 upon discovery to limit further losses, but a spokesperson declined to comment further on the source of the error or the details of the vulnerability.

According to CertiK monitoring, the Moonwell lending contract has been subjected to multiple attack transactions.The attacker exploited the incorrect price returned by the oracle (approximately $5.8 million), by borrowing about 0.02 wrstETH through a flash loan and depositing it, repeatedly borrowing over 20 wstETH, profiting 295 ETH (approximately $1 million).

ChainCatcher news, according to Cyvers Alerts monitoring, the USDC lending contract of Moonwell on the Optimism network has suffered a flash loan attack. The attacker used a malicious contract address as mToken to obtain unauthorized token approvals from Moonhackers, thereby stealing funds. The attacker received funding support through Tornado Cash on the Ethereum network, and the stolen USDC has been exchanged for DAI, which is currently stored in the attacker's wallet.

ChainCatcher news, according to the official announcement, Coinbase will add support for Moonwell (WELL) on the Base network (ERC-20 tokens). If liquidity conditions are met, trading will begin on September 24, 2024, at or after 9 AM Pacific Time.

ChainCatcher message, Coinbase Assets announced on platform X that Moonwell (WELL) on the Base network will be added to the coin listing roadmap.