Moonwell Faces Governance Attack Risking $1.08M in Assets

An unknown attacker has launched a low-cost assault on the decentralized lending protocol Moonwell, attempting to gain administrative control over its smart contracts on the Moonriver network through a deceptive governance proposal, putting approximately 1.08 million dollars in user assets at risk.

The incident unfolded in late March when the attacker funded a wallet and purchased about 40.17 million MFAM tokens, Moonwell's governance token, for roughly 1,600 MOVR, equivalent to 1,808 dollars, on the SolarBeam decentralized exchange. Within minutes, the attacker deployed a malicious smart contract and submitted Proposal 74, titled "MIPR39 Protocol Recovery Admin Migration." This measure sought to transfer administrative rights over seven lending markets, the Comptroller contract, and the price oracle to the attacker's contract, which contained embedded logic to drain the affected pools upon execution.

Moonwell operates on Moonbeam and Moonriver, parachains in the Polkadot ecosystem, allowing users to deposit assets for yield or borrow against collateral. The protocol's governance relies on MFAM token holders voting on proposals, with a 40 million token quorum threshold. The...