Briefing
The Moonwell lending protocol on the Base network was compromised via a Chainlink oracle malfunction that temporarily mispriced a wrapped liquid staking token (LST) collateral. This oracle failure created a false capital surplus, allowing a malicious actor to deposit a negligible amount of the LST and borrow significant assets against its artificially inflated value, resulting in a direct liquidity drain from the protocol. The attacker executed several rapid, leveraged transactions to maximize the exposure before the price feed corrected, securing a total profit of approximately $1.1 million in digital assets.
Context
The prevailing attack surface for lending protocols remains the reliance on external price feeds, particularly for volatile or complex assets like LSTs, which often lack the deep liquidity of primary assets. Prior to this event, the sector had documented numerous instances of oracle manipulation where protocols failed to implement robust sanity checks for extreme price deltas or stale timestamps. This specific incident underscores a persistent infrastructure dependency risk, where a glitch in a primary data provider can be immediately weaponized to exploit smart contract logic.
Analysis
The attack vector leveraged a temporary mispricing of the wrstETH token, where the Chainlink oracle feed briefly reported a value of $5.8 million for a small deposit of 0.02 wrstETH. The attacker deposited this small amount, which the lending contract’s logic accepted at the erroneous, highly inflated valuation, thereby establishing a massive borrowing capacity. They then proceeded to borrow large amounts of liquid assets like wstETH repeatedly against this synthetic collateral, effectively draining the pool. The speed of the attack, executed within a few blocks, was critical to preventing timely detection and liquidation, confirming the exploit was a technical arbitrage of a transient data-layer failure.
Parameters
- Total Funds Stolen → $1.1 Million (The approximate net profit secured by the attacker in ETH)
- Collateral Misvaluation → $5.8 Million (The temporary, erroneous value assigned to the small initial collateral deposit)
- Vulnerable Asset → wrstETH (The wrapped liquid staking token whose oracle price feed was compromised)
- Affected Blockchain → Base Network (The Layer 2 environment where the lending protocol operates)
Outlook
Immediate mitigation for users requires revoking approvals for any transaction executed during the compromise window and moving assets to secure, non-affected vaults. For protocol developers, this incident necessitates an immediate review of all oracle integration points to implement a robust secondary validation layer. New security best practices will mandate that lending protocols employ time-weighted average price (TWAP) feeds or implement strict, multi-source price sanity checks to prevent single-point-of-failure data anomalies from triggering catastrophic logic flows. Contagion risk is elevated for other protocols on Base and similar L2s that utilize LSTs with single-source oracle feeds.
