Moonwell's $1.12 nightmare: A pricing glitch just let bots seize millions in ETH collateral

CN
coindesk
Follow
1 hour ago


What to know : A misconfigured Chainlink price oracle on DeFi lender Moonwell briefly valued Coinbase Wrapped ETH (cbETH) at about $1 instead of roughly $2,200, leaving the protocol with nearly $1.8 million in bad debt. The error, triggered by a governance-approved oracle change that used only the cbETH-to-ETH ratio, allowed liquidation bots to seize 1,096.317 cbETH as if it were nearly worthless and enabled some users to borrow cheaply against minimal collateral. Moonwell quickly cut supply and borrow caps but could not immediately correct the oracle due to a required governance vote and five-day timelock, underscoring how critical and fragile price oracles are for DeFi applications.

A pricing error that lasted only minutes has left DeFi lender Moonwell with nearly $1.8 million in bad debt after a software glitch caused the value of Coinbase Wrapped ETH (cbETH) to drop to $1, instead of roughly $2,200, on the platform.

The technical glitch happened because a system update caused the platform to value cbETH based only on its relationship to ETH (about 1.12), forgetting to factor in the actual USD price of ether.

As a result, the protocol interpreted cbETH as being worth around $1.12, per an incident summary.

The issue began when a governance proposal enabled new Chainlink oracle configurations across Moonwell markets on Base and Optimism networks. An oracle is a tool that fetches real-time data before it is added to a blockchain.

In lending protocols such as Moonwell, users deposit assets like cbETH as collateral and borrow other tokens against them. If collateral falls below required thresholds, positions are automatically liquidated by bots that repay debt and seize collateral at a discount.

Once cbETH appeared to collapse from over $2,000 to just above $1, liquidation bots moved quickly. Because the protocol believed the token was nearly worthless, liquidators were able to repay roughly $1 of debt to seize one cbETH.

Risk manager Anthias Labs said 1,096.317 cbETH ($2.44 million) was seized, wiping out borrower collateral while leaving the protocol with bad debt across several markets.

The distorted pricing also allowed a smaller group of users to deposit minimal collateral and borrow cbETH at the artificially low valuation, further increasing losses.

Moonwell reduced supply and borrow caps within minutes to contain damage. However, correcting the oracle required a governance vote and a five day timelock, preventing an immediate fix.

The episode is the latest reminder that price oracles are foundational infrastructure and a key point of failure for DeFi applications. When they misfire, the smart contracts do exactly what they are programmed to do, but the balance sheet absorbs the consequences.

Meanwhile, security auditor Krum Pashov noted that GitHub commits tied to the proposal were co-authored by Claude Opus 4.6, an AI coding assistant, prompting debate over whether automated “vibe coding” contributed to the faulty oracle logic.

免责声明:本文章仅代表作者个人观点,不代表本平台的立场和观点。本文章仅供信息分享,不构成对任何人的任何投资建议。用户与作者之间的任何争议,与本平台无关。如网页中刊载的文章或图片涉及侵权,请提供相关的权利证明和身份证明发送邮件到support@aicoin.com,本平台相关工作人员将会进行核查。

Share To
APP

X

Telegram

Facebook

Reddit

CopyLink