Moonwell Reduces MAMO Borrow Cap to 1 Wei Following $8.7 Million Exploit

Moonwell, a decentralized lending protocol operating on Base, has taken drastic action by reducing the borrow cap for its MAMO Core Market to just 1 wei, the smallest unit of value on Ethereum-compatible chains. This decision effectively freezes borrowing within this market following a price manipulation exploit that allowed an attacker to siphon off around $8.7 million in assets.

The exploit involved the manipulation of the MAMO token's price, which is used as collateral in Moonwell's lending market. The attacker artificially inflated the market price of MAMO, then used it to borrow high-value assets, including over $4 million in cbBTC, Coinbase's wrapped Bitcoin product on Base. In response to this incident, Moonwell also tightened the supply caps for both MAMO and its governance token, WELL, to prevent further issues.

Prior to the exploit, the MAMO market operated under standard parameters, with a borrow cap of 3 million tokens and a collateral factor of 50%. The new cap of 1 wei effectively nullifies any meaningful borrowing capacity. Moonwell is currently conducting a comprehensive review of the exploit's impact, which will inform future decisions regarding the reopening of the MAMO market and the necessary safeguards.

This incident underscores a persistent vulnerability in decentralized finance (DeFi) lending protocols: oracle risk. These protocols depend on price feeds to assess collateral value, and when these feeds can be manipulated, the entire system is at risk. While large-cap tokens like ETH and BTC are less susceptible to such manipulation, lower-volume tokens like MAMO present a more accessible target for attackers.

As a result of this exploit, users of the Moonwell platform with exposure to the MAMO market now find themselves in a state of uncertainty. Borrowers cannot initiate new positions, and suppliers may have their assets locked until the protocol completes its assessment and decides on the next steps.

Recent Developments on Moonwell Exploit

• Moonwell lost approximately $8.7 million due to an exploit that did not involve hacking any smart contracts.
• The attacker manipulated the price of MAMO, a small Base token, allowing them to borrow real assets.
• Security firm Blockaid reported that 50.6 cbBTC, valued at over $4 million, was drained from Moonwell's mCBTC market.
• Moonwell has set borrow caps for all Core Markets on Base to 1 wei to prevent further borrowing and limit potential losses.
• This incident follows previous pricing failures that have cost Moonwell over $14 million in the past ten months.
• Moonwell is expected to provide further updates regarding the situation and the final bad debt once MAMO's price stabilizes.

New Facts About Moonwell Incident

• An attacker drained almost $9 million from Moonwell, a DeFi lending platform on the Base network.
• The exploit involved manipulating the collateral pricing of MAMO, which is a relatively illiquid token.
• The attacker inflated the price of MAMO, borrowing cbBTC from the mCBTC market.
• Approximately 50.6 cbBTC, valued at over $4 million, was drained during the attack.
• The attacker reportedly spent $7 million to pump MAMO's price and incurred an estimated loss of $3.8 million after selling it post-attack.
• The assets borrowed included cbBTC, USDC, WETH, and wstETH, with proceeds swapped for DAI, totaling 8.7 million DAI in a Tornado Cash-funded Ethereum address.
• This incident marks Moonwell's fourth exploit in less than a year, all related to pricing issues.
• Previous incidents included a $12 million liquidation during an October market crash and a $1.8 million bad debt from a contract error in February.