Moonwell Faces Governance Attack: $1.08 Million at Stake for Just $1,800 Investment

In a concerning turn of events, Moonwell was targeted by an attacker who spent roughly $1,800 to push through a harmful governance proposal that jeopardized $1.08 million worth of assets. This incident has raised alarms about the protocol's governance defenses.

Key Takeaways

An attacker utilized $1,800 to acquire approximately 40 million MFAM tokens and advance a malicious governance proposal on Moonwell.
The proposal, MIP-R39, aimed to transfer control of seven lending markets to the attacker, threatening to drain user funds.
Governance vulnerabilities persist in DeFi, allowing individuals to exploit low liquidity and weak voter participation.
Moonwell has mechanisms, including the "Break Glass Guardian," that could potentially counteract such attacks.
A similar security incident occurred in February, where faulty pricing led to significant debt for the protocol.

Moonwell MFAM price and governance proposal risk chart

Attack Overview

On March 26, an unidentified individual invested about $1,800 to obtain around 40 million MFAM tokens. This quick maneuver allowed them to introduce a harmful governance proposal in Moonwell’s Moonriver deployment, all within approximately 11 minutes. This proposal puts around $1.08 million of user funds at risk.

According to The Block's report, the attacker’s proposal, identified as MIP-R39, aims to transfer administrative rights over seven lending markets, the comptroller contract, and the price oracle to a contract controlled by the attacker. If successful, such access would enable the assailant to drain the protocol’s pools at will. Moonwell functions as a decentralized finance (DeFi) lending protocol on Moonbeam and Moonriver, both of which are parachains in the Polkadot ecosystem. Here, users can deposit their assets to earn yield or borrow against collateral.

The attack exploited a systemic flaw within token-based governance: when a protocol's governance token is trading at low prices and voter turnout is minimal, a malicious actor can gather enough voting power with little capital to push through unfavorable proposals. In this case, just $1,800 worth of MFAM was sufficient to secure quorum and lock in a vote before any substantial opposition could form.

Safety Mechanisms in Place

Voting on the controversial proposal will remain open until March 27. Although it initially reached quorum swiftly, the majority of votes now oppose it. The final outcome will depend on any remaining undeclared voting power. Additionally, Moonwell has a backup emergency multi-signature feature known as the “Break Glass Guardian.” This mechanism can override the governance process and remove the attacker’s access before the proposal is executed, regardless of the voting results.

This incident is not the first security breach Moonwell has faced recently. In February, the protocol experienced another exploit caused by a faulty oracle; it mispriced Coinbase Wrapped ETH (cbETH) at approximately $1 rather than its true market value of around $2,200, resulting in nearly $1.78 million in bad debt.

Ongoing Risks in DeFi

Governance attacks are becoming increasingly common in the world of decentralized finance, highlighting the struggle between open participation and security within protocols. The 2022 Beanstalk flash loan attack remains a stark example, where an attacker drained over $180 million by temporarily gaining enough voting power to pass a fraudulent proposal in a single transaction. Similarly, Compound Finance and the now-defunct Swerve Finance have encountered governance controversies fueled by concentrated token ownership.

What differentiates the Moonwell incident is its cost-effectiveness. Unlike other attacks, this one did not require flash loans; it only involved a simple market purchase of a low-liquidity token and a governance structure without effective checks to slow down adversarial proposals.

As the community and development team at Moonwell race against the March 27 vote deadline, the outcome will determine if mechanisms like the Break Glass Guardian can successfully neutralize the threat posed by the malicious proposal before it is executed.