Moonwell DeFi Protocol Loses $1.78M to Oracle Mispricing from Misconfigured Governance Update
Moonwell, a DeFi lending protocol, suffered a $1.78 million loss after a governance-approved oracle configuration change used only the cbETH-to-ETH exchange rate, mispricing Coinbase Wrapped Staked ETH at $1.12 instead of approximately $2,200. Liquidation bots and borrowers exploited the error before the protocol could correct it. Smart contract code co-authored by Anthropic's Claude Opus 4.6 prompted debate about AI-assisted code quality, though a security auditor noted the mistake could have been made by senior developers and could have been caught with proper integration testing.
What happened
A governance proposal executed on Sunday misconfigured the cbETH oracle by using the cbETH/ETH exchange rate alone, causing the system to report cbETH at about $1.12 instead of the correct price of approximately $2,200.
Liquidation bots and opportunistic borrowers exploited the mispricing, with liquidators seizing 1,096.317 cbETH and some users depositing minimal collateral to borrow against the artificially low valuation, leaving the protocol with roughly $1.78 million in bad debt.
Reported impact
The protocol lost approximately $1.78 million in bad debt as a result of the oracle misconfiguration and subsequent exploitation by liquidation bots and borrowers.
Index analysis
Pull requests for the affected contracts show multiple commits co-authored by Anthropic's Claude Opus 4.6, prompting security auditor Pashov to flag the incident as an example of AI-written or AI-assisted Solidity backfiring.
Pashov cautioned against treating the flaw as uniquely AI-driven, describing the oracle issue as the kind of mistake 'even a senior Solidity developer could have made,' and noting that the mispricing 'could have been caught with an integration test, a proper one, integrating with the blockchain.' The team had commissioned an audit from Halborn and said it had unit and integration tests in a separate pull request.
Governance controls
Moonwell reduced supply and borrow caps within minutes to contain damage. However, correcting the oracle required a governance vote and five-day timelock.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.