DeFi Lending Agreement Moonwell The lending market on Base has been attacked. On-chain tracking shows that attackers manipulated the price of collateral assets MAMO to lend out various real crypto assets, resulting in cumulative losses exceeding 9 million US dollars. As of press time, the project team has not released a complete explanation of the incident or the final loss figures.
MAMO price has been rapidly driven up
Blockchain security company CertiK stated that this incident did not directly exploit a vulnerability in the Moonwell contract, but rather took advantage of the thin market liquidity of MAMO, which makes it easier for prices to be manipulated by transactions.
On-chain data shows that the price of MAMO rose from approximately $0.0105 to $0.088, nearly 8 times the original price. Subsequently, the attackers used the inflated price of MAMO as collateral to borrow assets such as cbBTC, USDC, wstETH, and ETH in the Moonwell market.
Transferred assets exceed $9 million
According to CertiK, it has been confirmed that the assets transferred out amount to approximately 8.7 million US dollars. Another set of on-chain monitoring data shows that the total loss has exceeded 9 million US dollars.
Blockchain monitoring agency ExVul SkyEye mentioned that the largest single transfer involved 14.34 cbBTC, which, at the time's price, was approximately 1.15 million US dollars. The assets that were lent out were mainly cbBTC, USDC, wstETH, and ETH. These assets have greater liquidity and are also easier to transfer further.
Abnormal pricing occurred within the year.
This is not the first time that Moonwell has encountered security issues this year. On February 18th, Moonwell experienced pricing anomalies after enabling a related contract due to a governance proposal, which led to cbETH on Base having quotes that deviated significantly from market levels.
The issue at that time was related to the OEV wrapped contract of Chainlink. The report mentioned that some of the code for the relevant contract was contributed by Claude AI of Anthropic, but a key calculation step was omitted, which ultimately led to the cbETH, which was originally worth about $2,200, being incorrectly marked as $1.12 for a period of time.
Additional information:The previous pricing incident left approximately $1.78 million in bad debts for Moonwell. Following this new round of attacks, the native token of Moonwell fell by about 3%, trading at around $0.003407.
